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Preface 


The Curry-Howard isomorphism states an amazing correspondence between 
systems of formal logic as encountered in proof theory and computational 
calculi as found in type theory. For instance, minimal propositional logic 
corresponds to simply typed A-calculus, first-order logic corresponds to de- 
pendent types, second-order logic corresponds to polymorphic types, etc. 

The isomorphism has many aspects, even at the syntactic level: formulas 
correspond to types, proofs correspond to terms, provability corresponds to 
inhabitation, proof normalization corresponds to term reduction, etc. 

But there is much more to the isomorphism than this. For instance, 
it is an old idea—due to Brouwer, Kolmogorov, and Heyting, and later 
formalized by Kleene’s realizability interpretation—that a constructive proof 
of an implication is a procedure that transforms proofs of the antecedent 
into proofs of the succedent; the Curry-Howard isomorphism gives syntactic 
representations of such procedures. 

These notes give an introduction to parts of proof theory and related 
aspects of type theory relevant for the Curry-Howard isomorphism. 


Outline 


Since most calculi found in type theory build on A-calculus, the notes be- 
gin, in Chapter 1, with an introduction to type-free A-calculus. The intro- 
duction derives the most rudimentary properties of 8-reduction including 
the Church-Rosser theorem. It also presents Kleene’s theorem stating that 
all recursive functions are A-definable and Church’s theorem stating that 
G-equality is undecidable. 

As explained above, an important part of the Curry-Howard isomor- 
phism is the idea that a constructive proof of an implication is a certain 
procedure. This calls for some elaboration of what is meant by constructive 
proofs, and Chapter 2 therefore presents intuitionistic propositional logic. 
The chapter presents a natural deduction formulation of minimal and intu- 
itionistic propositional logic. The usual semantics in terms of Heyting alge- 
bras and in terms of Kripke models are introduced—the former explained 
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on the basis of Boolean algebras—and the soundness and completeness re- 
sults are then proved. An informal proof semantics, the so-called BHK- 
interpretation, is also presented. 

Chapter 3 presents the simply typed A-calculus and its most fundamen- 
tal properties up to the subject reduction property and the Church-Rosser 
property. The distinction between simply typed A-calculus à la Church and 
a la Curry is introduced, and the uniqueness of types property—which fails 
for the Curry system—is proved for the Church system. The equivalence 
between the two systems, in a certain sense, is also established. The chapter 
also proves the weak normalization property by the Turing-Prawitz method, 
and ends with Schwichtenberg’s theorem stating that the numeric functions 
representable in simply typed A-calculus are exactly the extended polyno- 
mials. 

This provides enough background material for our first presentation of 
the Curry-Howard isomorphism in Chapter 4, as it appears in the con- 
text of natural deduction for minimal propositional logic and simpy typed 
A-calculus. The chapter presents another formulation of natural deduction, 
which is often used in the proof theory literature, and which facilitates a finer 
distinction between similar proofs. The exact correspondence between nat- 
ural deduction for minimal propositional logic and simply typed A-calculus 
is then presented. The extension to product and sum types is also discussed. 
After a brief part on proof-theoretical applications of the weak normaliza- 
tion property, the chapter ends with a proof of strong normalization using 
the Tait-Girard method, here phrased in terms of saturated sets. 

Chapter 5 presents the variation of the Curry-Howard isomorphism in 
which one replaces natural deduction by Hilbert style proofs and simply 
typed A-calculus by simply typed combinatory logic. After type-free com- 
binators and weak reduction—and the Church-Rosser property—the usual 
translations from A-calculus to combinators, and vice versa, are introduced 
and shown to preserve some of the desired properties pertaining to weak 
reduction and (@-reduction. Then combinators with types are introduced, 
and the translations studied in this setting. Finally Hilbert-style proofs 
are introduced, and the connection to combinators with types proved. The 
chapter ends with a part on subsystems of combinators in which relevance 
and linearity play a role. 

Having seen two logics or, equivalently, two calculi with types, Chapter 6 
then studies decision problems in these calculi, mainly the type checking, 
the type reconstruction, and the type inhabitation problem. The type re- 
construction problem is shown to be P-complete by reduction to and from 
unification (only the reduction to unification is given in detail). The type 
inhabitation problem is shown to be PSPACE-complete by a reduction from 
the satisfiability problem for classical second-order propositional formulas. 
The chapter ends with Statman’s theorem stating that equality on typed 
terms is non-elementary. 
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After introducing natural deduction systems and Hilbert-style systems, 
the notes introduce in Chapter 7 Gentzen’s sequent calculus systems for 
propositional logic. Both classical and intuitionistic variants are introduced. 
In both cases a somewhat rare presentation—taken from Prawitz—with as- 
sumptions as sets, not sequences, is adopted. For the intuitionistic system 
the cut-elimination theorem is mentioned, and from this the subformula 
property and decidability of the logic are inferred. Two aproaches to term 
assignment for sequent calculus proofs are studied. In the first approach, 
the terms are those of the simply typed A-calculus. For this approach, the 
connection between normal forms and cut-free proofs is studied in some de- 
tail. In the second approach, the terms are intended to mimic exactly the 
rules of the calculus, and this assignment is used to prove the cut-elimination 
theorem in a compact way. 

The remaining chapters study variations of the Curry-Howard isomor- 
phism for more expressive type systems and logics. 

In Chapter 8 we consider the most elementary connections between nat- 
ural deduction for classical propositional logic and simply typed A-calculus 
with control operators, in particular, the correspondence between classical 
proof normalization and reduction of control operators. Kolmogorov’s em- 
bedding of classical logic into intuitionistic logic is shown to induce a con- 
tinuation passing style translation which eliminates control operators. 

Chapter 9 is about first-order logic. After a presentation of the syntax 
for quantifiers, the proof systems and interpretations seen in earlier chapters 
are generalized to the first-order case. 

Chapter 10 presents dependent types, as manifest in the calculus AP. 
The strong normalization property is proved by a translation to simply typed 
A-calculus. A variant of AP ala Curry is introduced. By another translation 
it is shown that a term is typable in AP a la Curry iff it is typable in simply 
typed A-calculus. While this shows that type reconstruction is no harder 
than in simply typed A-calculus, the type checking problem in AP a la Curry 
turns out to be undecidable. The last result of the chapter shows that first- 
order logic can be encoded in AP. 

In Chapter 11 we study arithmetic. The chapter introduces Peano Arith- 
metic (PA) and briefly recalls Gédel’s theorems and the usual result stating 
that exactly the recursive functions can be represented in Peano Arithmetic. 
The notion of a provably total recursive function is also introduced. Heyt- 
ing arithmetic (HA) is then introduced and Kreisel’s theorem stating that 
provable totality in HA and PA coincide is presented. Then Kleene’s real- 
izability interpretation is introduced—as a way of formalizing the BHK- 
interpretation—and used to prove consistency of HA. Gödel’s system T 
is then introduced and proved to be strongly normalizing. The failure of 
arithmetization of proofs of this property is mentioned. The result stating 
that the functions definable in T are the functions provably total in Peano 
Arithmetic is also presented. Finally, G6ddel’s Dialectica interpretation is 
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presented and used to prove consistency of HA and to prove that all func- 
tions provably total in Peano Arithmetic are definable in T. 

Chapter 12 is about second-order logic and polymorphism. For the sake 
of simplicity, only second-order propositional systems are considered. Natu- 
ral deduction, Heyting algebras, and Kripke models are extended to the new 
setting. The polymorphic A-calculus is then presented, and the correspon- 
dence with second-order logic developed. After a part about definability 
of data types, a Curry version of the polymorphic \-calculus is introduced, 
and Wells’ theorem stating that type reconstruction and type checking are 
undecidable is mentioned. The strong normalization property is also proved. 

The last chapter, Chapter 13, presents the A-cube and pure type systems. 
First Barendregt’s cube is presented, and its systems shown equivalent to 
previous formulations by means of a classification result. Then the cube is 
geneneralized to pure type systems which are then developed in some detail. 


About the notes 


Each chapter is provided with a number of exercises. We recommend that 
the reader try as many of these as possible. At the end of the notes, answers 
and hints are provided to some of the exercises.! 

The notes cover material from the following sources: 


e Girard, Lafont, Taylor: Proofs and Types, Cambridge Tracts in Theo- 
retical Computer Science 7, 1989. 


e Troelstra, Schwichtenberg: Basic Proof Theory, Cambridge Tracts in 
Theoretical Computer Science 43, 1996. 


e Hindley: Basic Simple Type Theory, Cambridge Tracts in Theoretical 
Computer Science 42, 1997. 


e Barendregt: Lambda Calculi with Types, pages 117-309 of Abram- 
sky, S. and D.M. Gabbay and T.S.E. Maibaum, editors, Handbook of 
Logic in Computer Science, Volume II, Oxford University Press, 1992. 


Either of these sources make excellent supplementary reading. 

The notes are largely self-contained, although a greater appreciation of 
some parts can probably be obtained by readers familiar with mathemat- 
ical logic, recursion theory and complexity. We recommend the following 
textbooks as basic references for these areas: 


e Mendelson: Introduction to Mathematical Logic, fourth edition, Chap- 
man & Hall, London, 1997. 


'This part is quite incomplete due to the “work-in-progress” character of the notes. 
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e Jones: Computability and Complexity From a Programming Perspec- 
tive, MIT Press, 1997. 


The notes have been used for a one-semester graduate/Ph.D. course 
at the Department of Computer Science at the University of Copenhagen 
(DIKU). Roughly one chapter was presented at each lecture, sometimes 
leaving material out. 

The notes are still in progress and should not be conceived as having 
been proof read carefully to the last detail. Nevertheless, we are grateful 
to the students attending the course for pointing out numerous typos, for 
spotting actual mistakes, and for suggesting improvements to the exposition. 

This joint work was made possible thanks to the visiting position funded 
by the University of Copenhagen, and held by the second author at DIKU 
in the winter and summer semesters of the academic year 1997-8. 


M.H.B.S. & P.U., May 1998 
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CHAPTER 1 


Type-free -calculus 


The A-calculus is a collection of formal theories of interest in, e.g., computer 
science and logic. The A-calculus and the related systems of combinatory 
logic were originally proposed as a foundation of mathematics around 1930 
by Church and Curry, but the proposed systems were subsequently shown 
to be inconsistent by Church’s students Kleene and Rosser in 1935. 

However, a certain subsystem consisting of the A-terms equipped with 
so-called (6-reduction turned out to be useful for formalizing the intuitive 
notion of effective computability and led to Church’s thesis stating that 
A-definability is an appropriate formalization of the intuitive notion of effec- 
tive computability. The study of this subsystem—which was proved to be 
consistent by Church and Rosser in 1936—was a main inspiration for the 
development of recursion theory. 

With the invention of physical computers came also programming lan- 
guages, and -calculus has proved to be a useful tool in the design, imple- 
mentation, and theory of programming languages. For instance, A-calculus 
may be considered an idealized sublanguage of some programming languages 
like LISP. Also, A-calculus is useful for expressing semantics of program- 
ming languages as done in denotational semantics. According to Hindley 
and Seldin [55, p.43], “A-calculus and combinatory logic are regarded as 
‘test-beds’ in the study of higher-order programming languages: techniques 
are tried out on these two simple languages, developed, and then applied to 
other more ‘practical’ languages.” 

The A-calculus is sometimes called type-free or untyped to distinguish it 
from variants in which types play a role; these variants will be introduced 
in the next chapter. 


1.1. -terms 


The objects of study in A-calculus are A-terms. In order to introduce these, 
it is convenient to introduce the notion of a pre-term. 
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1.1.1. DEFINITION. Let 
V= {vo,U1,.--} 


denote an infinite alphabet. The set A” of pre-terms is the set of strings 
defined by the grammar: 

Nos=V|(A Ss) AVA) 
1.1.2. EXAMPLE. The following are pre-terms. 


(i) ((vo v1) v2) € A5; 

(ii) (Avo (vo v1)) € A5; 

(iii) ((Avo vo) vi) € A5; 

) ((Avo (vo vo)) (Avi (v1 v1))) E A. 


(iv 


1.1.3. NOTATION. We use uppercase letters, e.g., K, L, M, N, P,Q, R with or 
without subscripts to denote arbitrary elements of A~ and lowercase letters, 
e.g., x, Y, 2 with or without subscripts to denote arbitrary elements of V. 


1.1.4. TERMINOLOGY. 


(i) A pre-term of form x (i.e., an element of V) is called a variable; 
(ii) A pre-term of form (Ax M) is called an abstraction (over x); 
(iii) A pre-term of form (M N) is called an application (of M to N). 
The heavy use of parentheses is rather cumbersome. We therefore intro- 
duce the following, standard conventions for omitting parentheses without 


introducing ambiguity. We shall make use of these conventions under a 
no-compulsion/no-prohibition agreement—see Remark 1.1.10. 


1.1.5. NOTATION. We use the shorthands 


(i 
(ii 


(K L M) for ((K L) M); 

(Ax Ay M) for (Ax (Ay M)); 
(iii) (Az M N) for (Ax (M N)); 
(iv) (M Ax N) for (M (Ax N)). 


We also omit outermost parentheses. 


) 
) 
) 
) 


1.1.6. REMARK. The two first shorthands concern nested applications and 
abstractions, respectively. The two next ones concern applications nested 
inside abstractions and vice versa, respectively. 

To remember the shorthands, think of application as associating to the 
left, and think of abstractions as extending as far to the right as possible. 
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When abstracting over a number of variables, each variable must be 
accompanied by an abstraction. It is therefore convenient to introduce the 
following shorthand. 


1.1.7. NOTATION. We write Azı... £n.M for Azı ... A£n M. As a special 
case, we write Ax.M for Ax M. 


1.1.8. REMARK. Whereas abstractions are written with a A, there is no cor- 
responding symbol for applications; these are written simply by juxtaposi- 
tion. Hence, there is no corresponding shorthand for applications. 


1.1.9. EXAMPLE. The pre-terms in Example 1.1.2 can be written as follows, 
respectively: 


(i) vo v1 v2; 
(ii 
(iii 
(iv 
1.1.10. REMARK. The conventions mentioned above are used in the remain- 
der of these notes. However, we refrain from using them—wholly or partly— 
when we find this more convenient. For instance, we might prefer to write 
(Avo.vo vo) (Av1.v1 U1) for the last term in the above example. 


) AvV9-VO U1; 
) (Avo.vo) v1; 
) (Avo.vo vo) AV1.VI1 Ul. 


1.1.11. DEFINITION. For M € A` define the set FV(M) C V of free variables 
of M as follows. 


FV(a) = {r}; 
FV(Az.P) = FV(P)\{z}; 
FV(PQ) = FV(P)UFV(Q). 


If FV(M) = {} then M is called closed. 

1.1.12. EXAMPLE. Let x,y,z denote distinct variables. Then 
(i) FV(a y z) = {x,y,z}; 

(ii) FV(Az.2 y) = {y}; 

(iii) FV((Av.x x) Ay.y y) = {}. 


1.1.13. DEFINITION. For M,N € A” and z €E V, the substitution of N for x 
in M, written M|x := N] € A, is defined as follows, where x Æ y: 


na N] =Ay.Plia := N], if y Z FV(N) or x € FV(P); 
; Az.Ply := z|[e:= N], ify € FV(N) and z € FV(P). 


i 
zZ 
I 
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where z is chosen as the v; € V with minimal i such that v; ¢ FV(P)UFV(N) 
in the last clause. 


1.1.14. EXAMPLE. If x,y,z are distinct variables, then for a certain vari- 
able u: 


((Ax.x yz) (Ay. y z) (Az.x y 2)) [x := y] = (Az.x yz) (Au.y u z) (Az-y y z) 


1.1.15. DEFINITION. Let a-equivalence, written =a, be the smallest relation 
on A~, such that 


B= 5. P for all P; 
Az.P =a ày.P|x := y] ify gFV(P), 


and closed under the rules: 


Pap > YreEV: Ax.P =a Az.P'; 
P=, P' > VWZEN: PZP 
P=, P' s YZE = GPa ZP 
PeP x PiP 
P&P l PSP os PS Ph 


1.1.16. EXAMPLE. Let x,y, z denote different variables. Then 


(i) Ag =a Ay 
(ii 


(iii 


ADL Z =a AY-Y Z; 
AD.AY.LY =a AY.AL.Y T; 


) 

) 

) 

(iv) AT.£ Y Fa Ae Z. 

1.1.17. DEFINITION. Define for any M € A, the equivalence class [M]a by: 
[M] ={NeEAN |M =a N} 

Then define the set A of A-terms by: 

A = M/=a = {[Mla|MEM} 


1.1.18. WARNING. The notion of a pre-term and the associated explicit dis- 
tinction between pre-terms and A-terms introduced above are not standard 
in the literature. Rather, it is customary to call our pre-terms A-terms, and 
then informally remark that a-equivalent -terms are “identified.” 


In the remainder of these notes we shall be almost exclusively concerned 
with A-terms, not pre-terms. Therefore, it is convenient to introduce the 
following. 
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1.1.19. NOTATION. We write M instead of [M]q in the remainder. This 
leads to ambiguity: is M a pre-term or a A-term? In the remainder of these 
notes, M should always be construed as [M]q E€ A, except when explicitly 
stated otherwise. 


We end this section with two definitions introducing the notions of free 
variables and substitution on A-terms (recall that, so far, these notions have 
been introduced only for pre-terms). These two definitions provide the first 
example of how to rigorously understand definitions involving A-terms. 


1.1.20. DEFINITION. For M € A define the set FV(M) C V of free variables 
of M as follows. 


FV(2) = {x}; 
EV(AGP) = FV(P)\{r}; 
FV(PQ) = FV(P)UFV(Q). 


If FV(M) = {} then M is called closed. 


1.1.21. REMARK. According to Notation 1.1.19, what we really mean by this 
is that we define FV as the map from A to subsets of V satisfying the rules: 


FV([z]a) = {x}; 
FV([At.Pla) = FV([Plo)\{@}; 
FV([P Qla) = FV([Plo) U FV([Q]a). 


Strictly speaking we then have to demonstrate there there is at most one such 
function (uniqueness) and that there is at least one such function (existence). 

Uniqueness can be established by showing for any two functions FV; and 
FV». satisfying the above equations, and any A-term, that the results of FV; 
and FV2 on the A-term are the same. The proof proceeds by induction on 
the number of symbols in any member of the equivalence class. 

To demonstrate existence, consider the map that, given an equivalence 
class, picks a member, and takes the free variables of that. Since any choice 
of member yields the same set of variables, this latter map is well-defined, 
and can easily be seen to satisfy the above rules. 

In the rest of these notes such considerations will be left implicit. 


1.1.22. DEFINITION. For M,N € A and x €E V, the substitution of N for x 
in M, written M{x := N}, is defined as follows: 


x|z := N] = N; 

ylz := N] = y, if cAy; 

(P Q)lz := N] = Pļ|z:= N] Ole := N]; 

Ag. Vaal | = Aa le := N], if e~y, where y g FV(N). 


1.1.23. EXAMPLE. 
G) (Ax.x ge àz.z] = Arey: 
(i) Aga y)ly := àz.z] = Ax.x àz.z. 
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1.2. Reduction 


Next we introduce reduction on A-terms. 


1.2.1. DEFINITION. Let —g be the smallest relation on A such that 


(Az.P) Q >g Pix := Q], 
and closed under the rules: 
PogP => WeeV: dAt.P >g àz.P' 
PogP > YZEA: PZAgP'Z 
PogP > YZEA: ZP>Z P 
A term of form (Ax.P) Q is called a G-redex, and P|x := Q] is called its 


GB-contractum. A term M is a B-normal form if there is no term N with 
M >g N. 


There are other notions of reduction than 8-reduction, but these will not 
be considered in the present chapter. Therefore, we sometimes omit “G-” 
from the notions G-redex, G-reduction, etc. 


1.2.2. DEFINITION. 


(i) The relation—» g (multi-step G-reduction) is the transitive-reflexive clo- 
sure of +; that is, —»g is the smallest relation closed under the rules: 


P >} P' => P— g Pe 
P—g P' & P'—>g P" => P—g P"; 
P—g P. 


(ii) The relation =g (G-equality) is the transitive-reflexive-symmetric clo- 
sure of —g; that is, =g is the smallest relation closed under the rules: 


P >g P' => P=g P'; 
P = P&P =, P" > P =œ Ps 
P =g P; 

P = Pp’ > P' =, P. 


1.2.3. WARNING. In these notes, the symbol = without any qualification is 
used to express the fact that two objects, e.g., pre-terms or A-terms are 
identical. This symbol is very often used in the literature for 3-equality. 


1.2.4. EXAMPLE. 
(i 
(ii 


(iii 


) (Ax.x £) Az.z >g (x x)[x := Az.z] = (Az.z) Ay-y; 
) (Az.z) Ay-y >g 2[z = Ay-y] = Ay-y; 

) (Au.x £) Az.z—g rY-Y; 

) ( 


(iv) (Ax.x) y z =, y ((Ax.x) z). 
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1.3. Informal interpretation 


Informally, -terms express functions and applications of functions in a pure 
form. For instance, the A-term 


T= \x.x 


intuitively denotes the function that maps any argument to itself, i.e., the 
identity function. This is similar to the notation n +> n employed in math- 
ematics. However, Axv.x is a string over an alphabet with symbols 4, x, etc. 
(or rather an equivalence class of such objects), whereas n +> n is a function, 
i.e., a certain set of pairs. The difference is the same as that between a pro- 
gram written in some language and the mathematical function it computes, 
e.g., addition. 

As in the notation n+ n, the name of the abstracted variable x in Ax.x 
is not significant, and this is why we identify Axv.x with, e.g., Ay.y. 

Another A-term is 

K* = Ay.Ax.x 


which, intuitively, denotes the function that maps any argument to a func- 
tion, namely the one that maps any argument to itself, i.e., the identity 
function. This is similar to programming languages where a function may 
return a function as a result. A related A-term is 


K = Ay.Ax-y 


which, intuitively, denotes the function that maps any argument to the 
function that, for any argument, returns the former argument. 

Since A-terms intuitively denote functions, there is a way to invoke one 
A-term on another; this is expressed by application. Thus, the A-term 


IK 


expresses application of I to K. Since K intuitively denotes a function too, 
I denotes a function which may have another function as argument. This is 
similar to programming languages where a procedure may receive another 
procedure as argument. 

In mathematics we usually write application of a function, say f(n) = n?, 
to an argument, say 4, with the argument in parentheses: f(4). In the 
A-calculus we would rather write this as (f 4), or just f4, keeping Nota- 
tion 1.1.5 in mind. Not all parentheses can be omitted, though; for instance, 


(Ax.x)I Axa 


are not the same A-term; the first is I applied to I, whereas the second 
expects an argument x which is applied to I. 
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Intuitively, if Ax.M denotes a function, and N denotes an argument, 
then the the value of the function on the argument is denoted by the A-term 
that arises by substituting N for x in M. This latter \-term is exactly the 
term 


This is similar to common practice in mathematics; if f is as above, then 
f(4) = 4’, and we get from the application f(4) to the value 4? by substi- 
tuting 4 for n in the body of the definition of f. 

The process of calculating values is formalized by G-reduction. Indeed, 
M —, N if N arises from M by replacing a (-redex, i.e., a part of form 


(Az.P) Q 


by its 6-contractum. 


For instance, 
IK = (\z.x2) K >g z|x := K] = K 


Then the relation —>» g formalizes the process of computing the overall result. 
Also, =g identifies A-terms that, intuitively, denote the same function. 
Note that -calculus is a type-free formalism. Unlike common mathe- 
matical practice, we do not insist that A-terms denote functions from cer- 
tain domains, e.g., the natural numbers, and that arguments be drawn from 
these domains. In particular, we may have self-application as in the \-term 


w = AT. £ 
and we may apply this A-term to itself as in the A-term 
Q=ww 


The type-free nature of A-calculus leads to some interesting phenomena; 
for instance, a A-term may reduce to itself as in 


Q = (Az.2 2) w >gww=Q 
Therefore, there are also A-terms with infinite reduction sequences, like 


Q >g Q >g... 


1.4. The Church-Rosser Theorem 


Since a A-term M may contain several 8-redexes, i.e., several parts of form 
(Ax.P) Q, there may be several N such that M —>g N. For instance, 


K (I I) >g Azx.(I I) 
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and also 
K (II) -g KI 


However, the Church-Rosser theorem, proved below, states that if 
M— M, 


and 
M—»g M2 


then a single A-term M3 can be found with 
Mı — 6B M3 


and 
Mə e, M3 


In particular, if Mı and M2 are G-normal forms, i.e., A-terms that admit 
no further G-reductions, then they must be the same A-term, since the 8- 
reductions from Mı and Mz to M3 must be in zero steps. This is similar to 
the fact that when we calculate the value of an arithmetical expression, e.g., 


(44+ 2)-(84+7)-11 
the end result is independent of the order in which we do the calculations. 


1.4.1. DEFINITION. A relation > on A satisfies the diamond property if, for 
all Mı, Mo, M3 € A, if Mı > Mə and Mı > M3, then there exists an M4 € A 
such that Mə > M4 and M3 > M4. 


1.4.2. LEMMA. Let > be a relation on A and suppose that its transitive clo- 


sure! is —» 3. If > satisfies the diamond property, then so does —> g. 


PROOF. First show by induction on n that Mı > N, and Mı >... > Mn 
implies that there are No,...,N, such that Ny > No >... > Nn and 
Mn > Nn. 

Using this property, show by induction on m that if Mı >... > Nm and 


N, >* Mı then there are Mg,... , Mm such that Mı > Mə >... > Mm and 
Nm >* Mm. 


‘Let R be a relation on A. The transitive closure of R is the least relation R* satisfying: 
PRP’ => PRP’ 
PR*P’ & P’R*P" > PR*P”" 
The reflexive closure of R is the least relation R7 satisfying: 


PRP’ => PRP’ 
PRP 
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Now assume Mı —>g8 Mp and Mı —»g M3. Since —»g is the transitive 
closure of > we have Mı >... > Mə and Mı >... > M3. By what was 
shown above, we can find M4 such that Mə >... > M4 and M3 >... > M4. 
Since — g is the transitive closure of >, also My—»g M4 and M3—», My. O 


1.4.3. DEFINITION. Let —; be the relation on A defined by: 


P-»| P 

P-»| P' => x.P—», r\x.P' 

Pœ P & QQ > PQ) PR 

P-| P' & Q—~>ı Q' => (Ax.P) Q— | P(x = Q'] 


1.4.4. LEMMA. M >, M' & N-, N > M[x:= N| —>ı M'|x := N”. 


PROOF. By induction on the definition of M —>;, M’. In case M’ is M, 
proceed by induction on M. O 


1.4.5. LEMMA. —», satisfies the diamond property, i.e., for all Mı, M2, M3 € A, 
if Mı —, M2 and Mı —, Mz, then there exists an M4 E A such that 
Mo =>] Ma and M3 —>] Mg. 


PROOF. By induction on the definition of Mı —»; Mo, using the above 
lemma. O 


1.4.6. LEMMA. — g is the transitive closure of —ı. 


PROOF. Clearly? 


Then 
= (>88) CS p) =—>g 


In particular, =" =—> g. oO 


1.4.7. THEOREM (Church and Rosser, 1936). For every Mı, Mo, M3 € A, if 
Mı >g Mz and Mı —> g M3, then there exists an M4 € A such that Mo —> 6 
Ma and M3 —> g Ma. 


ProoF (Tait & Martin-Löf). By the above three lemmas. oO 


1.4.8. COROLLARY. For all M,N € A, if M =g N, then there exists an 
L € A such that M—»g L and N —>g} L. 


1.4.9. COROLLARY. For all M, Ni, No € A, if M—»g Nı and M—»g No and 
both Nı and Nə are in B-normal form, then Ni = No. 


?Recall the relations R* and R= defined earlier. 
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1.4.10. COROLLARY. For all M,N € A, if there are G-normal forms Lı and 
Lo such that M—»g Lı, N—»g Lo, and Li # Lo, then M #6 N. 


1.4.11. EXAMPLE. Az.x Ag Ax.Ay.2. 


1.4.12. REMARK. One can consider the lambda calculus as an equational 
theory, i.e., a formal theory with formulas of the form M =g N. The 
preceding example establishes consistency of this theory, in the following 
sense: there exists a formula P which cannot be proved. 

This may seem to be a very weak property, compared to “one cannot 
prove a contradiction” (where a suitable notion of “contradiction” in ordi- 
nary logic is e.g., P \ =P). But note that in most formal theories, where a 
notion of contradiction can be expressed, its provability implies provability 
of all formulas. Thus, consistency can be equally well defined as “one cannot 
prove everything”. 


1.5. Expressibility and undecidability 


Although we have given an informal explanation of the meaning of A-terms 
it remains to explain in what sense G-reduction more precisely can express 
computation. In this section we show that A-calculus can be seen as an 
alternative formulation of recursion theory. 

The following gives a way of representing numbers as -terms. 


1.5.1. DEFINITION. 


(i) For any n € N and F, A € A define F'"(A) (n-times iterated application 
of F to A) by: 


F°(A) A 
FeVi(A) = F(E"(A)) 


(ii) For any n € N, the Church numeral cn is the A-term 


Cn = NS. AZZ) 


1.5.2. EXAMPLE. 


(i 


) co = As.Xrz.2; 
(i) Cy = ABALS z; 
) 

) 


(iii) co = As.Az.8 (s z); 


(iv) cg = As.Az.s (s (s z)). 


1.5.3. REMARK. Cn is the number n represented inside the A-calculus. 


The following shows how to do arithmetic on Church numerals. 
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1.5.4. PROPOSITION (Rosser). Let 


A, = da.dy.r8.rz.2 s (ys 2); 
A, = dAx.ry.r38.x (y s); 
Ae = AT.AYY T. 


Then 
Ai Gn Cm = Gima 
Ax Cn Cm Cnm; 
AeCn Cm = Cnm ifm>Q. 


PROOF. For any n €N, 


Cnsz = (Af.Ax.f”(x))sz 
=g (Ax.s”(x))z 
=g 8"(z) 
Thus 
AGG, Ga = (Ax. ày. As. Az.x s (y s zZ)) Cn €m 


=g A8.AZ.Cn S (Cm S 2) 
=g As.Az.cn s (s™(z)) 
=g As.Az.s"(s™(z)) 
=)  A8s.Az.s"™(z) 


= Cn4m 


The similar properties for multiplication and exponentiation are left as ex- 
ercises. o 


1.5.5. REMARK. Recall that M =g N when, intuitively, M and N denote 
the same object. For instance I I =g I since both terms, intuitively, denote 
the identity function. 

Now consider the two terms 


As Ax.AS.AZ.S (x£ s z) 
Al = Az.As.àz.z s (s z) 


It is easy to calculate that 


Ás Cn =8 Gaga 
1 
A% Cn =B Cn+1 


So both terms denote, informally, the successor function on Church numer- 
als, but the two terms are not 8-equal (why not?) 


The following shows how to define booleans and conditionals inside A- 
calculus. 
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1.5.6. PROPOSITION. Define 


true = Az.Ay.z; 
false = Azx.ry.y; 
if B then P else Q= BPQ. 


Then 
if true then P else Q =g P; 
if false then P else Q =g Q. 


PROOF. We have: 


if true then P else Q = (Az.ry.z) PQ 
=a (Ay-P)Q 
=g P. 
The proof that if false then P else Q =, Q is similar. oO 


We can also define pairs in A-calculus. 


1.5.7. PROPOSITION. Define 


T1 = A\x.rAy.r; 
T2 = AT.Ay.y 


Then 


PROOF. We have: 


[P,Q] mi = (Az.x PO) Ae Ae 
= Un-rya) PQ 
=a (ày.P)Q 
aE 
The proof that [P,Q] 72 =g Q is similar. m 


1.5.8. REMARK. Note that we do not have [M_mı, M 72] =g M for all 
M € A; that is, our pairing operator is not surjective. 


1.5.9. REMARK. The construction is easily generalized to tuples [M1,... , Mn] 
with projections m; where i € {1,... n}. 


The following gives one way of expressing recursion in A-calculus. 
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1.5.10. THEOREM (Fixed point theorem). For all F there is an X such that 
F X = X 
In fact, there is a -term Y such that, for all F: 


F (Y F) =Y F 


PROOF. Put 
Y = Af.(Ax.f (x @)) AGF (x x) 
Then 
YF = CLOG? (x x)) àx.f (x x)) F 
= (Ax.F (x x)) Atk (x x) 
=g F ((Ax.F (x x)) Ax.F (x x)) 
=a F ((Af.(Ax.f (x x)) Av.f (x x)) F) 
= F(YF) 
as required. O 


1.5.11. COROLLARY. Given M € A there is F € A such that: 


F =; MIf =F 

PROOF. Put 
F=Y \f.M 
Then 
F = YAfM 

=g (Af.M) (Y Af.M) 

= (Af.M)F 

=p M[f:= F] 
as required. O 


Corollary 1.5.11 allows us to write recursive definitions of A-terms; that 
is, we may define F as a \-term satisfying a fixed point equation F =g Ax.M 
where the term F occurs somewhere inside M. However, there may be 
several terms F satisfying this equation (will these be G-equal?). 


1.5.12. EXAMPLE. Let C be some A-term which expresses a condition, i.e., 
let C cn =g true or C cn =g false, for all n € N. Let S define the successor 
function (see Remark 1.5.5). Suppose we want to compute in A-calculus, for 
any number, the smallest number greater than the given one that satisfies 
the condition. This is expressed by the A-term F: 


H = Af.Axif (C x) then z else f (S x) 
F = YH 
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Indeed, for example 
Fo = (YH) 
=, A (Y H) C4 
= (Af.Axif (C x) then z else f (S x)) (Y H) c4 
=g if (C c4) then cq else (Y H) (S c4) 
= if (C c4) then c4 else F (S c4) 


So far we have been informal as to how A-terms “express” certain func- 
tions. This notion is made precise as follows. 


1.5.13. DEFINITION. 


(i) A numeric function is a map 


f: N" AN. 
(ii) A numeric function f : N™ — N is \-definable if there is an F € A such 
that 
F Cn, +++ Cam =B Cf(n1,... Nnm) 
for all n1,...,2m EN. 


1.5.14. REMARK. By the Church-Rosser property, (ii) implies that, in fact, 
F Cn, +++ Cnm mes) Cfi(ni,... nm) 


There are similar notions for partial functions—see [7]. 
We shall show that all recursive functions are A-definable. 


1.5.15. DEFINITION. The class of recursive functions is the smallest class of 
numeric functions containing the initial functions 


(i 
(ii 
(iii) zero: Z(n) = 0. 


projections: U;” (n1,... ,%m) = n; for all 1 <i < m; 


SSH, Sy 


successor: St(n) =n+1; 


and closed under composition, primitive recursion, and minimization: 


(i) composition: if g : N! — N and hi,... ‚hp : N” — N are recursive, 
then so is f : N™ — N defined by 


Fies Nm) = glhi(mi,... Nm) stig tase , Tm). 


(ii) primitive recursion: if g : N” — N and h : N™+? — N are recursive, 
then so is f : Ntt — N defined by 


FO ni,- Nm) = g(mi,-.. , Nm); 
f(n+1,1741,...,%m) We (Alcs Nm) N, Wig A) 
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(iii) minimization: if g : N"+! — N is recursive and for all nj,... , nm there 
is an n such that g(n,n1,... , nm) =0, then f : N” — N defined as 
follows is also recursive? 


f (Mises: Nm) = Pg hive tin) — 0 


1.5.16. LEMMA. The initial functions are -definable. 


PROOF. With 
UP SN AC ee 
St = Ag.As.àz.s (x 8 z) 
Z = AT.Co 
the necessary properties hold. oO 


1.5.17. LEMMA. The A-definable functions are closed under composition. 


Proor. If g : N* — N is \-definable by G € A and hy,... ,hy : N” — N 
are A-definable by some Hj,... , Hp € A, then f : N™ — N defined by 


f(ni,... nm) = OC ... Ti) , ie) 
is A-definable by 


F= Atire Abas (HT Bis yp) es (A osim); 


as is easy to verify. o 


1.5.18. LEMMA. The A-definable functions are closed under primitive recur- 
sion. 


Proor. If g : N™ — N is à-definable by some G € A and h: N+? — N is 
à-definable by some H € A, then f : N+! — N defined by 


F (0; ig sos Nm) ES Coa amn 
FAP 1 iss Sg) = RA(f(Nn,Nni,... Nm) ig ee Nm) 


is A-definable by F € A where 


F = REN tee eT |c0, G z1... ty | T2; 
T Ap.[S* (p 71), H (p m2) (p T1) 21... Eml]. 


Indeed, we have 


Fen Ce es =o Cn T leg G Cr: - - - Cnm] T2 


=g T”([co, G Cn; ---Cnm]) T2 


m 


3un.g(n,n1,...,%m) =0 denotes the smallest number n satisfying the equation 
g(n,ni,...,2m) = 0. 
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Also, 


T [cn, CFin,ni,... ieil =8 [S+ (cn), H Cf (nyn1,...;%m) Cn Cni +++ Cnm] 
= [en41, Ch(f (n,n1,... nm) nni,- ee 
=p [Cn+1, Cf(n+1,n1,... nm) 
So 
T” ([co, G Cny +- Crm) =6 [ens Cf(nyni,... PE 
From this the required property follows. O 


1.5.19. LEMMA. The A-definable functions are closed under minimization. 


PROOF. If g : N™+! — N is \-definable by G € A and for all ny,... , Nnm 
there is an n, such that g(n,n1,...,%m) = 0, then f : N” — N defined by 


Fig Nm) = ILA N1,... ae) =O 
is A-definable by F € A, where 
F = a....A\Lm.H co 
and where H € A is such that 
H =g dy.if (zero? (G z1... £m y)) then y else H (S* y). 


Here, 
zero? = \x.x (Ay.false) true 


We leave it as an exercise to verify that the required properties hold. oO 


The following can be seen as a form of completeness of the A-calculus. 


1.5.20. THEOREM (Kleene). All recursive functions are \-definable. 


PROOF. By the above lemmas. oO 


The converse also holds, as one can show by a routine argument. Similar 
results hold for partial functions as well—see [7]. 


1.5.21. DEFINITION. Let (e, e) : N? — N be a bijective, recursive function. 
The map # : A — N is defined by: 


#(v:) = (0,4) 
#(Ar.M) (2, (#(2), #(M))) 
#(M N) (3, EM), #(N))) 


For M € A, we take #(M) to be the least possible number #( M’) where M’ 
is an alpha-representative of M. Also, for M € A, we define [M] = cym). 
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1.5.22. DEFINITION. Let AC A. 
(i) A is closed under =g if 
MEA& M= N>NEA 
(ii) A is non-trival if 
AAQ0& AFA 
(iii) A is recursive if 
#A = {#(M)|M € A} 
is recursive. 


1.5.23. THEOREM (Curry, Scott). Let A be non-trivial and closed under =g. 
Then A is not recursive. 


PROOF (J. Terlouw). Suppose A is recursive. Define 
B={M|M[M]e« A} 
There exists an F € A with 
MeB & F[|M] =g c; 
MZB & F[M]=@c. 
Let Mo € A, Mı E€ A\A, and let 
G = \Azx.if (zero? (F x)) then Mı else Mo 


Then 
MeB e G [M] = Mı 
MgB <= G[M]=g¢ Mo 
so 
GEB © GJ|G]l=M_ > G{[G|¢A => G¢B 
GEB & G/Gl=sM > G[Gl)eA > GEB 


a contradiction. o 


1.5.24. REMARK. The above theorem is analogous to Rice’s theorem known 
in recursion theory. 


The following is a variant of the halting problem. Informally it states that 
the formal theory of 8-equality mentioned in Remark 1.4.12 is undecidable. 


1.5.25. COROLLARY (Church). {M € A| M =g true} is not recursive. 


1.5.26. COROLLARY. The following set is not recursive: 


{M EA|INEA:M—sN & N is a B-normal form }. 


One can also infer from these results the well-known theorem due to 
Church stating that first-order predicate calculus is undecidable. 
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1.6. Historical remarks 


For more on the history of A-calculus, see e.g., [55] or [7]. First hand in- 
formation may be obtained from Rosser and Kleene’s eye witness state- 
ments [94, 62], and from Curry and Feys’ book [24] which contains a wealth 
of historical information. Curry and Church’s original aims have recently 
become the subject of renewed attention—see, e.g., [9, 10] and [50]. 


1.7. Exercises 


1.7.1. EXERCISE. Show, step by step, how application of the conventions in 
Notation 1.1.5 allows us to express the pre-terms in Example 1.1.2 as done 
in Example 1.1.9. 


1.7.2. EXERCISE. Which of the following abbreviations are correct? 
1. Az.x y = A) y; 
2. x.x y = àx.(x y); 
3. Ax.Ay.Az.x y z = (Ax.ày.àz.x) (y z); 
4. A£.Ay.Az.x y z = ((Ax.\y.Az.£) y) z; 


5. Ag.Ay.Az.x0 y z = Az. ày. Az.((x y) z). 


1.7.3. EXERCISE. Which of the following identifications are correct? 
1. Az.Ay.£x = Ay.AD.Y; 
2. (Ax.x) z = (Az.z) z. 
1.7.4. EXERCISE. Do the following terms have normal forms? 
1. I, where Azx.z; 
2. Q, ie., ww, where w = Av.x T; 
3. KIQ where K = Az.\y.z; 
4. (Az. KI (x x)) Ay. KI (y y); 


5. (Ax.z (x x)) Ay.z (y y). 


1.7.5. EXERCISE. A reduction path from a A-term M is a finite or infinite 
sequence 


M >g Mı >g M2 >68... 
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A term that has a normal form is also called weakly normalizing (or just 
normalizing), since at least one of its reduction paths terminate in a nor- 
mal form. A term is strongly normalizing if all its reduction paths even- 
tually terminate in normal forms, i.e., if the term has no infinite reduction 
paths. Which of the five terms in the preceding exercise are weakly /strongly 
normalizing? In which cases do different reduction paths lead to different 
normal forms? 


1.7.6. EXERCISE. Which of the following are true? 
1. (Ax.ày.Az.(x z) (y z)) Au.u =p (Av.v Ay.àz.Au.u) AL.Z; 
2. (Ax. ày.x Az.z) Aa.a =g (Ay-y) àb. àz.z; 
3. AL.Q =g Q. 


1.7.7. EXERCISE. Prove (without using the Church-Rosser Theorem) that 
for all Mı, M2, M3 € A, if Mı >g Mə and Mı —g Ms, then there exists an 
My, € A such that My—, M4 and M3 —> g Ma4. 

Can you extend your proof technique to yield a proof of the Church- 
Rosser theorem? 


1.7.8. EXERCISE. Fill in the details of the proof Lemma 1.4.4. 
1.7.9. EXERCISE. Fill in the details of the proof Lemma 1.4.5. 


1.7.10. EXERCISE. Which of the following are true? 
1. (II) (II)— II; 
2. (II) (II); T; 
3. IIII—; III; 


4. IIII—; I; 


1.7.11. EXERCISE. Show that the fourth clause in Definition 1.4.3 cannot be 
replaced by 
(Axz.P) Q—>ı Plax := Q]. 


That is, show that, if this is done, then —»; does not satisfy the diamond 
property. 


1.7.12. EXERCISE. Prove Corollary 1.4.8-1.4.10. 


1.7.13. EXERCISE. Write \-terms (without using the notation s”(z)) whose 
G-normal forms are the Church numerals cs and cjg. 
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1.7.14. EXERCISE. Prove that A, and A, satisfy the equations stated in 
Proposition 1.5.4. 


1.7.15. EXERCISE. For each n € N, write a A-term Bn such that 
Bn ci Q1..-Qn =e Qi, 
for all Q1,..-Qn E A. 


1.7.16. EXERCISE. For each n € N, write A-terms P,,71,...,7», such that 
for all Q1,...,Qn EA: 


(Po Qiu Qn) Ti =8 Qi. 


1.7.17. EXERCISE (Klop, taken from [7]). Let Axız2...£n.M be an abbre- 
viation for A£1.A£2.... A£n.M. Let 


? Aabcde f ghijklmnopqstuvwayzr.r (thisisa fixedpointcombinator); 
$ = ?????????????????????????? 


Show that $ is a fixed point combinator, i.e., that $ F =g F ($ F), holds for 
al FEA. 


1.7.18. EXERCISE. Define a A-term neg such that 


neg true =, false; 
neg false =g true. 


1.7.19. EXERCISE. Define A-terms O and E such that, for all n € N: 


Gees true ifm is odd; 
m8) false otherwise, 
and 
Ec — true if m is even; 
m8) false otherwise. 


1.7.20. EXERCISE. Define a A-term P such that 
P enti =B Cn 
Hint: use the same trick as in the proof that the A-definable functions are 


closed under primitive recursion. (Kleene got this idea during a visit at his 
dentist.) 
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1.7.21. EXERCISE. Define a A-term eq? such that, for all n,m € N: 


ov, ae ae true ifm=n; 
d? Cn €m =$ ] false otherwise. 
Hint: use the fixed point theorem to construct a A-term H such that 


H cncm =g if (zero? cn) 
then (if (zero? cm) then true else false) 
else (if (zero? cm) then false else (H (P cn) (P cm))) 


where P is as in the preceding exercise. 
Can you prove the result using instead the construction in Lemma 1.5.18? 


1.7.22. EXERCISE. Define a A-term H such that for all n € N: 
H Can =B Cn 

1.7.23. EXERCISE. Define a A-term F such that for all n € N: 
H Cy2 =8 Cn, 


1.7.24. EXERCISE. Prove Corollary 1.5.25. 


CHAPTER 2 


Intuitionistic logic 


The classical understanding of logic is based on the notion of truth. The 
truth of a statement is “absolute” and independent of any reasoning, un- 
derstanding, or action. Statements are either true or false with no regard 
to any “observer”. Here “false” means the same as “not true”, and this is 
expressed by the tertium non datur principle that “p V ~p” must hold no 
matter what the meaning of p is. 

Needless to say, the information contained in the claim p V 7p is quite 
limited. Take the following sentence as an example: 


There is seven 7’s in a row somewhere in the decimal represen- 
tation of the number r. 


Note that it may very well happen that nobody ever will be able to determine 
the truth of the above sentence. Yet we are forced to accept that one of the 
cases must necessarily hold. Another well-known example is as follows: 


There are two irrational numbers x and y, such that x” is ratio- 
nal. 


The proof of this fact is very simple: if eo? is a rational number then we 


can take z = y = v2; otherwise take £ = ee and y = V2. 

The problem with this proof is that we do not know which of the two 
possibilities is the right one. Again, there is very little information in this 
proof, because it is not constructive. 

These examples demonstrate some of the drawbacks of classical logic, 
and give hints on why intuitionistic (or constructive) logic is of interest. 
Although the roots of constructivism in mathematics reach deeply into the 
XIXth Century, the principles of intuitionistic logic are usually attributed 
to the works of the Dutch mathematician and philosopher Luitzen Egber- 
tus Jan Brouwer from the beginning of XXth Century. Brouwer is also the 
inventor of the term “intuitionism”, which was originally meant to denote a 
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philosophical approach to the foundations of mathematics, being in opposi- 
tion to Hilbert’s “formalism”. 

Intuitionistic logic as a branch of formal logic was developed later around 
the year 1930. The names to be quoted here are Heyting, Glivenko, Kol- 
mogorov and Gentzen. To learn more about the history and motivations 
see [26] and Chapter 1 of [107]. 


2.1. Intuitive semantics 


In order to understand intuitionism, one should forget the classical, Platonic 
notion of “truth”. Now our judgements about statements are no longer based 
on any predefined value of that statement, but on the existence of a proof 
or “construction” of that statement. 

The following rules explain the informal constructive semantics of propo- 
sitional connectives. These rules are sometimes called the BHK-interpretation 
for Brouwer, Heyting and Kolmogorov. The algorithmic flavor of this defi- 
nition will later lead us to the Curry-Howard isomorphism. 


e A construction of pı A p2 consists of a construction of pı and a con- 
struction of p2; 


e A construction of pı V p2 consists of a number i € {1,2} and a con- 
struction of of pi; 


e A construction of pı — p2 is a method (function) transforming every 
construction of pı into a construction of p2; 


e There is no possible construction of L (where L denotes falsity). 


Negation ~g is best understood as an abbreviation of an implication y —> L. 
That is, we assert ~y when the assumption of ọ leads to an absurd. It follows 
that 


e A construction of =p is a method that turns every construction of p 
into a non-existent object. 


Note that the equivalence between ~y and p — L holds also in classical 
logic. But note also that the intuitionistic statement ~y is much stronger 
than just “there is no construction for p”. 


2.1.1. EXAMPLE. Consider the following formulas: 
1. L—> p; 
2. ((p > q) > p) > p; 


3. p > 5P; 
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4. ==p > p; 

5. 0P > p; 

6. (~q > =p) > (p > q); 
7. (p > q) > (4 > =p); 


8. a(p ^q) > (p V ~q); 


9. (p V =q) > ~(p ^ q); 
10. ((p = q) = r) = (p > (q > r)); 
11. ((p^q) > r) e (p > (q > r)); 
12. (p > q) > (~p V q); 


13. —~~(p V =p). 


These formulas are all classical tautologies. Some of them can be easily 
given a BHK-interpretation, but some of them cannot. For instance, a con- 
struction for formula 3, which should be written as “p > ((p > L) > L)”, 
is as follows: 


Given a proof of p, here is a proof of (p —> L) > L: Take a proof 
of p — L. It is a method to translate proofs of p into proofs 
of L. Since we have a proof of p, we can use this method to 
obtain a proof of L. 


On the other hand, formula 4 does not seem to have such a construction. 
(The classical symmetry between formula 3 and 4 disappears!) 


2.2. Natural deduction 


The language of intuitionistic propositional logic is the same as the language 
of classical propositional logic. We assume an infinite set PV of propositional 
variables and we define the set ® of formulas by induction, represented by 
the following grammar: 


Ð := 1 | PV | (© > ð) | (v 8) | (8A 4), 


That is, our basic connectives are: implication —, disjunction V, conjunc- 
tion A, and the constant L (false). 


2.2.1. CONVENTION. The connectives ~ and « are abbreviations. That is, 


e ~y abbreviates y > L; 
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e p «= y abbreviates (p => Y) A (Y > p). 


2.2.2. CONVENTION. 


1. 


We sometimes use the convention that implication is right associative, 
i.e., we write e.g. p —> w — ù instead of y > ( > ù). 


. We assume that negation has the highest, and implication the lowest 


priority, with no preference between V and A. That is, apAq >r 
means ((~p) Aq) >r. 


. And of course we forget about outermost parentheses. 


In order to formalize the intuitionistic propositional calculus, we define a 
proof system, called natural deduction, which is motivated by the informal 
semantics of 2.1. 


2.2.3. WARNING. What follows is a quite simplified presentation of natural 
deduction, which is often convenient for technical reasons, but which is not 
always adequate. To describe the relationship between various proofs in 
finer detail, we shall consider a variant of the system in Chapter 4. 


2.2.4. DEFINITION. 


(i) 


A contezt is a finite subset of ®. We use I, A, etc. to range over 
contexts. 


The relation [ F is defined by the rules in Figure 2.1. We also write 
Fy for F. 


We write T, A instead of T U A, and I, instead of T, {y}. We also 
write F y instead of {} F ọ. 


A formal proof of T F ọ is a finite tree, whose nodes are labelled by 
pairs of form (I, y’), which will also be written I’ F y’, satisfying the 
following conditions: 


e The root label is TF gy; 
e All the leaves are labelled by axioms; 


e The label of each father node is obtained from the labels of the 
sons using one of the rules. 


For infinite I we define [ F y to mean that I'o F vy, for some finite 
subset To of T. 


If F y then we say that ọ is a theorem of the intuitionistic propositional 
calculus. 
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T, pF » (Ax) 
Tro TEH THY THA 
p Y AD p AE) pnw 
TrypAwp Trg TRFw 
Te Te T,o-p T,wtp TrKyv 
-EDE er Y erp. T,yFp p Y (VE) 
Trypvwp Trevwy Trop 
T, F rH Te 
THY >y THY% 
TRL 
=—— (LE) 
[Tro 


Figure 2.1: INTUITIONISTIC PROPOSITIONAL CALCULUS 


The proof system consists of an axiom scheme, and rules. For each logical 
connective (except L) we have one or two introduction rules and one or two 
elimination rules. An introduction rule for a connective è tells us how a 
conclusion of the form yew can be derived. An elimination rule describes 
the way in which yew can be used to derive other formulas. The intuitive 
meaning of T F y is that y is a consequence of the assumptions in T. 

We give example proofs of our three favourite formulas: 


2.2.5. EXAMPLE. Let T abbreviate {py — (Yy > ¥),y > p, p}. 


H 
eae (31) 
rp 


Pwr yp 
pryp 
F g> W> y) 


(> 1 
(> 1 


(iii) 

TEF g> (y> h) rF o rTFo>y Tre 
THY THY% 
THV a 

gr WV) propre (oD) 
p = (Y => V) F (p => Y) > (p => d) Si 
F (p > (Y > ù)) > (Y > Y) > (Y => d) 
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2.2.6. REMARK. Note the distinction between the relation +, and a formal 
proof of TF y. 


The following properties will be useful. 


2.2.7. LEMMA. Intuitionistic propositional logic is closed under weakening 
and substitution, that is, T F y implies T, Y F p and T[|p := 4] F ylp:= 4%], 
where |p := w] denotes a substitution of w for all occurrences of a proposi- 
tional variable p. 


PROOF. Easy induction with respect to the size of proofs. oO 


2.3. Algebraic semantics of classical logic 


To understand better the algebraic semantics for intuitionistic logic let us 
begin with classical logic. Usually, semantics of classical propositional for- 
mulas is defined in terms of the two truth values, 0 and 1 as follows. 


2.3.1. DEFINITION. Let B = {0,1}. 


(i) A valuation in B is a map v : PV — B; such a map will also be called 
a 0-1 valuation. 


(ii) Given a 0-1 valuation v, define the map [e], : ® — B by: 


[o]v = v(p), for p € PV; 
[1]. = 0; 

[pve]. = max{[y]o, [Jot 

l^lo = min{[y]o, vlo}; 

[p> yle = max{l — [ylv; [Y)}- 


We also write v(y) for [yy]. 


(iii) A formula ọ € Ẹ is a tautology if u(y) = 1 for all valuations in 


Let us consider an alternative semantics, based on the analogy between 
classical connectives and set-theoretic operations. 


2.3.2. DEFINITION. A field of sets (over X ) is a nonempty family R of sub- 
sets of X, closed under unions, intersections and complement (to X). 


It follows immediately that {}, X € R, for each field of sets R over X. 
Examples of fields of sets are: 


(i) P(X); 


(ii) {10.5}; 
(iii) {A C X : A finite or —A finite} (—A is the complement of A). 
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2.3.3. DEFINITION. Let R be a field of sets over X. 


(i) A valuation in R is a map v : PV > R. 
(ii) Given a valuation v in R, define the map |e], : ® — X by: 


[pleo = v(p) for p € PV 
[1]. = {} 

leyyl = leh Y ih 

leal = lln ih 

[y T Ylo = (X- lelo) U [vle 


We also write v(y) for [y]v- 


2.3.4. PROPOSITION. The above two approaches to semantics are equivalent, 
i.e., the following conditions are equivalent for each field of subsets R over 
a nonempty set X: 


1. p is a tautology; 


2. u(y) = X, for all valuations v in R. 


PROOF. (1) => (2): Suppose that u(y) # X. There is an element a € X 
such that a ¢ v(y). Define a 0-1 valuation w so that w(p) = 1 iff a € v(p). 
Prove by induction that for all formulas w 


w(yp)=1 if aev(y). 


Then w(y) £ 1. 


(2) = (1): A 0-1 valuation can be seen as a valuation in R that assigns only 
X and {} to propositional variables. oO 


2.3.5. DEFINITION. A Boolean algebra is an algebraic system of the form 
B = (B,U, N, —,0, 1), where: 


e U,N are associative and commutative; 
e (aUb)Nc=(aNc)U(bNce) and (anb)Uc=(aUc)N(bUc); 
e aU0=a and anl=a; 


e —aUa=1 and —aNa=0Q. 


The relation < defined by a < b iff a Ub = b is a partial order! in every 
Boolean algebra, and the operations N,U are the glb and lub operations 
w.r.t. this order. 


TA transitive, reflexive and anti-symmetric relation. 
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The notion of a Boolean algebra is a straightforward generalization of 
the notion of a field of sets. Another example of a Boolean algebra is the 
algebra of truth values (B, max, min, —,0,1), where —x is 1 — z. 

We can generalize the above set semantics to arbitrary Boolean algebras 
by replacing valuations in a field of sets by valuations in a Boolean algebra 
in the obvious way. But in fact, every Boolean algebra is isomorphic to a 
field of sets, so this generalization does not change our semantics. 


2.4. Heyting algebras 


We will now develop a semantics for intuitionistic propositional logic. 
Let ® be the set of all propositional formulas, let T C © (in particular T 
may be empty) and let ~ be the following equivalence relation: 


goxy if TrRypowandrtyoy. 
Let Lr = ®/. = {[y]~ : Y E€ ®}, and define a partial order < over Lp by: 
ll~ < iyl iff Treo 


That ~ is an equivalence relation and that < is a well-defined partial order 
is a consequence of the following formulas being provable: 


e p — y; 
© (p> 4) > (Y > 9) > (y > 8); 


In addition, we can define the following operations over £r: 


lj ul = lav A]; 
la] Nne = [asb]; 
-lal~ = Paj. 


These operations are well-defined, because the following formulas are prov- 
able: 


e (Y > ') = y'> ~y); 
e (Y > g") = (w > ¥) > (y y) > (w vy); 
ep) (bP) => (YAY) HAY). 


We can go on and show that operations N and U are the glib and lub opera- 
tions w.r.t. the relation <, and that the distributivity laws 


(aUb)Nc=(aNne)U(bNc) and (anb)Uc=(aUc)N(bUCc) 
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are satisfied.? The class [L]~ is the least element 0 of Lp, because L > y 
is provable, and [T]~, where T = | — L, is the top element 1. We have 
[T] = {y: T+ p}. However, there are (not unexpected) difficulties with 
the complement operation: We have —a Na = [1]. but not necessarily 
—aUa = |T]n. 

The best we can assert about —a is that it is the greatest element such 
that —a N a = 0, and we can call it a pseudo-complement. Since negation 
is a special kind of implication, the above calls for a generalization. An 
element c is called a relative pseudo-complement of a with respect to b, iff c 
is the greatest element such that aNc < b. The relative pseudo-complement, 
if it exists, is denoted a => b. 

It is not difficult to find out that in our algebra Lr, often called a Lin- 
denbaum algebra, we have [y]~ => [W]~ = [p > vn. 

We have just discovered a new type of algebra, called Heyting algebra or 
pseudo-Boolean algebra. 


2.4.1. DEFINITION. A Heyting algebra is an algebraic system of the form 
H = (H,U,N,=>,—,0,1), that satisfies the following conditions: 


e U,N are associative and commutative; 

e (aUb)Nc=(aNnc)U(bNc) and (anb)Uc=(aUc)N(bUc); 
eaU0=a and anl=a; 

e aUa =q; 

e aNc < bis equivalent to c < a = b (where a < b stands for aU b = b); 
e —a =a > 0. 


The above conditions amount to as much as saying that H is a distributive 
lattice with zero and relative pseudo-complement defined for each pair of 
elements. In particular, each Boolean algebra is a Heyting algebra with 
a = b defined as —a U b. The most prominent example of a Heyting algebra 
which is not a Boolean algebra is the algebra of open sets of a topological 
space, for instance the algebra of open subsets of the Euclidean plane R?. 


2.4.2. DEFINITION. 
e The symbol o(a, b) denotes the distance between points a,b € R?; 


e A subset A of R? is open iff for every a € A there is an r > 0 with 
{b ER? : o(a, b) <r} CA; 


e If A is a subset of R? then Int(A) denotes the interior of A, i.e., the 
union of all open subsets of A. 


?That is, Lr is a distributive lattice. 
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2.4.3. PROPOSITION. Let H = (O(R?),U,N,>,~,0,1), where 
e O(R?) is the family of all open subsets of R?; 
e the operations N, U are set-theoretic; 
e A> B:= Int(—AUB), for arbitrary open sets A and B; 
e 0={} and1 =R?. 
e ~ A = Int(—A), where — is the set-theoretic complement. 


Then H is a Heyting algebra. 


PROOF. Exercise 2.7.6. O 


In fact, every Heyting algebra is isomorphic to a subalgebra of the algebra 
of open sets of a topological space. A comprehensive study of the algebraic 
semantics for intuitionistic (and classical) logic is the book of Rasiowa and 
Sikorski [88]. See also Chapter 13 of [108]. 

The semantics of intuitionistic propositional formulas is now defined as 


follows. 
2.4.4. DEFINITION. Let H = (H,U,N,=,—,0,1) be a Heyting algebra. 


(i) A valuation v in a H isa map v: PV > H. 
(ii) Given a valuation v in H, define the map [e], : ® — H by: 


lele = v(p) for p € PV 
Hle = 0 

leyvl = lehu ih 

leavl = ilon iyl] 


le > vl = kh > [vh 
As usual, we write u(y) for [ọ]v- 


2.4.5. NOTATION. Let H = (H,U,N,=,—,0,1) be a Heyting algebra. We 
write: 


e H,v H y, whenever u(y) = 1; 
e HE y, whenever H,v E y, for all v; 
H,v ET, whenever H,v E 9, for all y ET; 


e HET, whenever H,v ET, for all v; 


e = y, whenever H,v E ọ, for all H, v; 
T E y, whenever H, v HT implies H, v = o, for all H and v. 
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We say that a formula y such that = ọ is intuitionistically valid or is an 
intuitionistic tautology. It follows from the following completeness theorem 
that the notions of a theorem and a tautology coincide for intuitionistic 
propositional calculus. 


2.4.6. THEOREM (Soundness and Completeness). The following conditions 
are equivalent 


1.TK 9g; 

2.7 ee: 
PROOF. (1) = (2): Verify that all provable formulas are valid in all Heyting 
algebras (induction w.r.t. proofs). 


(2) = (1): This follows from our construction of the Lindenbaum algebra. 
Indeed, suppose that T = y, but T 7 y. Then y # T, ie., [p]~ #1 in £r. 
Define a valuation v by v(p) = [p]~ in £r and prove by induction that 
v(w) = [v]~, for all formulas w. It follows that v(y) 4 1, a contradiction. 


oO 


2.4.7. EXAMPLE. To see that Peirce’s law ((p — q) — p) —> p is not intu- 
itionistically valid, consider the algebra of open subsets of R?. Take v(p) to 
be the whole space without one point, and v(q) = {}. (Note that a> b= 1 
in a Heyting algebra iff a < b.) 


Intuitionistic logic is not finite-valued: There is no single finite Heyting 
algebra H such that F is equivalent to H = y. Indeed, consider the 
formula V{pi > pj : i,j = 0,...,n andi Æ j}. (Here the symbol V 
abbreviates the disjunction of all members of the set.) This formula is not 
valid in general (Exercise 2.7.10), although it is valid in all Heyting algebras 
of cardinality at most n. 

But finite Heyting algebras are sufficient for the semantics, as well as 
one sufficiently “rich” infinite algebra. 


2.4.8. THEOREM. 


1. A formula y of length n is valid iff it is valid in all Heyting algebras 
of cardinality at most 2?" ; 


2. Let H be the algebra of all open subsets of a dense-in-itself*® metric 
space V (for instance the algebra of all open subsets of Rè). Then 


HE y iff y is valid. 


3Every point x is a limit of a sequence {xn}n, where £n # x, for all n. 
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We give only a sketch of the main ideas of the proof, for the most curious 
reader. See [88] for details. 


For (1), suppose H,v F y, and let y1,...Ym be all subformulas of y. 
We construct a small model H’ as a distributive sublattice of H, with 0 
and 1, generated by the elements v(y1),... , v(m). This lattice is a Heyting 
algebra (warning: this is not a Heyting subalgebra of H), and H’,v’ K y, 
for a suitable v’. 

As for (2), every finite algebra can be embedded into the algebra of open 
subsets of some open subset of V, and this algebra is a homomorphic image 
of H. Thus, every valuation in a finite algebra can be translated into a 
valuation in H. 


From part (1) of the above theorem, it follows that intuitionistic propo- 
sitional logic is decidable. But the upper bound obtained this way (double 
exponential space) can be improved down to polynomial space, with help of 
other methods, see [103]. 


2.5. Kripke semantics 
We now introduce another semantics of intuitionistic propositional logic. 


2.5.1. DEFINITION. A Kripke model is defined as a tuple of the form C = 
(C,<, IF ), where C is a non-empty set, < is a partial order in C and IF isa 
binary relation between elements of C (called states or possible worlds) and 
propositional variables, that satisfies the following monotonicity condition: 


Ife<c¢ andclt p then d IF p. 


The intuition is that elements of the model represent states of knowledge. 
The relation < represents extending states by gaining more knowledge, and 
the relation |I} tells which atomic formulas are known to be true in a given 
state. We extend this relation to provide meaning for propositional formulas 
as follows. 


2.5.2. DEFINITION. If C = (C,<, IF ) is a Kripke model, then 
eclhyovw iff clk gor clF y; 
eclhkpAw iff clF gand clF y; 


e clHy—y iff c lF y, for all c such that c< d and d IF y; 


e c |F L never happens. 


We use C |F y to mean that c IF y, for all c € C. 


Note that the above definition implies the following rule for negation: 
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e clay if d yọ, for alle >c. 
and the following generalized monotonicity (proof by easy induction): 
If e< and c lF y then d IF y. 


We now want to show completeness of Kripke semantics. For this, we trans- 
form every Heyting algebra into a Kripke model. 


2.5.3. DEFINITION. A filter in a Heyting algebra H = (H,U, N, =, —, 0, 1) is 
a nonempty subset F of H, such that 


e a,b € F implies aN b € F; 
e a€ F anda < b implies b € F. 


A filter F is proper if F # H. A proper filter F is prime if aUb € F 
implies that either a or b belongs to F. 


2.5.4. LEMMA. Let F be a proper filter in H and leta ¢ F. There exists a 
prime filter G such that F CG anda g G. 


We only give a hint for the proof that can be found e.g., in [88]. Consider 
the family of all filters G containing F and such that a ¢ G, ordered by 
inclusion. Apply Kuratowski-Zorn Lemma to show that this family has a 
maximal element. This is a prime filter (Exercise 2.7.12) although it is not 
necessarily a maximal proper filter. 


2.5.5. LEMMA. Let v be a valuation in a Heyting algebra H. There is a 
Kripke model C = (C, <, |F ), such that H,v = y if C IF ọ, for all formu- 
las ọ. 


PROOF. We take C to be the set of all prime filters in H. The relation < 
is inclusion, and we define F IF- p iff v(p) € F. By induction, we prove that, 
for all formulas Y, 


Filho if v) eEF. (2.1) 


The only nontrivial case of this induction is when Y = y’ — y”. Assume 
F IF y — y", and suppose that u(y — Y”) = v(v’) = v(y") g F. Take 
the least filter G” containing F' U {v(w’)}. Then 


G' = {b : b > f Nv(y’) for some f € F}, 


and we have v(w”) ¢ G', in particular G’ is proper. Indeed, otherwise 
u(y") > f Avy’), for some f € F, and thus f < u(y’) => u(y") € F — 


a contradiction. 
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We extend G” to a prime filter G, not containing v(w”). By the induction 
hypothesis, G IF y’. Since F IF a)’ > y”, it follows that G IF y”. That is, 
u(w”) € G — a contradiction. 

For the converse, assume that v(y' = Ww”) € F C GIF wv’. From the 
induction hypothesis we have v(w’) € G and since F C G we obtain v(y') > 
u(y") € G. Thus v(y") > vyp) N wp) = vy") € G, and from the 
induction hypothesis we conclude G IF 7” as desired. 

The other cases are easy. Note that primality is essential for disjunction. 
Having shown (2.1), assume that C IF y and H,v K y. Then v(y) Æ 1 
and there exist a proper filter not containing v(y). This filter extends to a 
prime filter G such that u(y) ¢ G and thus G/F y. On the other hand, if 
H,v H y, then v(y) = 1 and 1 belongs to all filters in H. o 


2.5.6. THEOREM. The sequent T F y is provable iff for all Kripke models C, 
the condition C |F T implies C IF yp. 


PROOF. The left-to-right part is shown by induction (Exercise 2.7.13). For 
the other direction assume I / y. Then H,v HT but H, v F ọ, for some 
H,v. From the previous lemma we have a Kripke model C with C I- T and 
CK y. o 


Here is a nice application of Kripke semantics. 
2.5.7. PROPOSITION. If pV w then either F p ork w. 


PROOF. Assume’ y and 7 w. There are Kripke models Cı = (C1, <1, IF 1) 
and C2 = (C2, <2, IF 2) and states cı € C1 and cp € C2, such that cı Ky 
and co Æ w. Without loss of generality we can assume that cı and c9 
are least elements of Cı and C2, respectively, and that C1 N C2 = {}. Let 
C = (Cy U C2 U {co}, <, IF), where co ¢ Cy U Co, the order is the union of 
<; and <2 extended by co taken as the least element, and IF is the union 
of IF ı and |F 9. That is, 
Co K P, 


for all variables p. It is easy to see that this is a Kripke model. In addition 
we have C, cı IF V iff C1,c1 IF ®, for all formulas V, and a similar property 
holds for cə. 

Now suppose that + y Vw. By soundness, we have co Ik y V w, and thus 
either cg IF y or co IF Y, by definition of Ik . Then either cı IF y or ca IF 4, 
because of monotonicity. oO 


2.6. The implicational fragment 


The most important logical conjective is the implication. Thus, it is mean- 
ingful to study the fragment of propositional calculus with only one connec- 
tive: the implication. This is the true minimal logic. The natural deduction 


2.7. Exercises 37 


system for the implicational fragment consists of the rules (— E), (— I) and 
the axiom scheme. 


2.6.1. THEOREM. The implicational fragment of intuitionistic propositional 
calculus is complete with respect to Kripke models, i.e., T F y is provable iff 
for all Kripke models C, the condition C |I- T implies C IF y. 


PROOF. The implication from left to right follows from soundness of the full 
natural deduction system, of which our minimal logic is a fragment. For the 
proof in the other direction, let us assume that T 7 p. We define a Kripke 
model C = (C,<, IF ), where 


C={A:I CA, and A is closed under F}. 


That is, A € C means that A F w implies Y € A. 
The relation < is inclusion and | is €, that is, A IF p holds iff p € A, 
for all propositional variables p. By induction we show the following claim: 


Al- y iff YEA, 


for all implicational formulas ~ and all states A. The case of a variable is 
immediate from the definition. Let Y be yı —> We and let A IF w. Take A’ = 
{0 : A, yı F 0}. Then a € A’ and, by the induction hypothesis, A’ IF 1. 
Thus A’ IF y% and we get Y € A’, again by the induction hypothesis. Thus, 
A, %1 F %2, and by (—> I) we get what we want. 

Now assume w € A (that is A+ w) and take A’ > A with A’ IF y1. 
Then %1 € A’, i.e., A’ F yy. But also A’ F wy, — Y2, because A C A’. By 
(— E) we can derive A’ F p2, which means, by the induction hypothesis, 
that A’ IH po. O 


The completeness theorem has a very important consequence: the con- 
servativity of the full intuitionistic propositional calculus over its implica- 
tional fragment. 


2.6.2. THEOREM. Let y be an implicational formula, and let T be a set of 
implicational formulas. IfT F p can be derived in the intuitionistic proposi- 
tional calculus then it can be derived in the implicational fragment. 


ProoF. Easy. But note that we use only one half from the two completeness 
theorems 2.5.6 and 2.6.1: we need only soundness of the full logic and only 
the other direction for the fragment. O 


2.7. Exercises 


2.7.1. EXERCISE. Find constructions for formulas (1), (3), (5), (7), (9), (11) 
and (13) of Example 2.1.1, and do not find constructions for the other for- 
mulas. 


38 Chapter 2. Intuitionistic logic 


2.7.2. EXERCISE. Prove Lemma 2.2.7. 


2.7.3. EXERCISE. Give natural deduction proofs for the formulas of Exer- 
cise 2.7.1. 


2.7.4. EXERCISE. Show that the relation < defined in a Boolean algebra by 
the condition a < b iff a U b = b is a partial order and that 


e aNb< a; 
e the condition a < b is equivalent to a N b = a; 


e the operations U and N are respectively the upper and lower bound 
wrt. <; 


e the constants 0 and 1 are respectively the bottom and top element. 


2.7.5. EXERCISE. Show that the relation < defined in a Heyting algebra by 
the condition a < b iff a U b = b is a partial order and that 


e —a Na = Q; 
e (aUb)Na=aandanb<a; 
e the condition a < b is equivalent to a N b = a, and to a > b= 1; 


e the operations U and N are respectively the upper and lower bound 
wrt. <; 


e the constants 0 and 1 are respectively the bottom and top element. 
2.7.6. EXERCISE. Prove Proposition 2.4.3. 


2.7.7. EXERCISE. Fill in the details of the proof that the Lindenbaum alge- 
bra Lp of 2.4 is indeed a Heyting algebra. 


2.7.8. EXERCISE. Complete the proof of the completeness theorem 2.4.6. 


2.7.9. EXERCISE. Show that the formulas (2), (4), (6), (8) and (10) are not 
intuitionistically valid. (Use open subsets of R? or construct Kripke models.) 


2.7.10. EXERCISE. Show that the formula V{p; > p; : i,j = 0,...,n and 
i Æ j} is not intuitionistically valid. 


2.7.11. EXERCISE. A filter is maximal iff it is a maximal proper filter. Show 
that each maximal filter is prime. Show also that in a Boolean algebra every 
prime filter is maximal. 


2.7.12. EXERCISE. Complete the proof of Lemma 2.5.4. 
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2.7.13. EXERCISE. Complete the proof of Theorem 2.5.6, part =. (Hint: 
choose a proper induction hypothesis. ) 


2.7.14. EXERCISE. Can the proof of Theorem 2.6.1 be generalized to the full 
propositional calculus? 


2.7.15. EXERCISE. A state c in a Kripke model C determines p iff either 
clF por cl ap. Define a 0-1 valuation ve by velp) = 1 iff c IF p. Show that 
if c determines all propositional variables in y then v-(y) = 1 implies c IF y. 


2.7.16. EXERCISE. Let y be a classical tautology such that all propositional 
variables in y are among p1,... ,Pn. Show that the formula (pı V =p) > 
+++ (Pn V 7Pn) > ¢& is intuitionistically valid. 


2.7.17. EXERCISE. Prove the Glivenko theorem: A formula ọ is a classical 
tautology iff ~~g is an intuitionistic tautology. 


2.7.18. WARNING. The Glivenko theorem does not extend to first-order logic. 
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CHAPTER 3 


Simply typed -calculus 


Recall from the first chapter that a A-term, unlike the functions usually 
considered in mathematics, does not have a fixed domain and range. Thus, 
whereas we would consider the function n +> n? as a function from natural 
numbers to natural numbers (or from integers to natural numbers, etc.) 
there is no corresponding requirement in A-calculus. Or, to be more precise, 
there is no corresponding requirement in type-free A-calculus. 

Curry [23] and Church [18] also introduced versions of their systems with 
types. These systems form the topic of the present chapter. 


3.1. Simply typed A-calculus à la Curry 
We begin with the simply typed A-calculus a la Curry. 
3.1.1. DEFINITION. 


(i) Let U denote a denumerably infinite alphabet whose members will be 
called type variables. The set II of simple types is the set of strings 
defined by the grammar: 


II ::= U | (II > II) 
We use a, 8,... to denote arbitrary type variables, and o,7,... to de- 


note arbitrary types. We omit outermost parentheses, and omit other 
parentheses with the convention that — associates to the right. 


(ii) The set C of contexts is the set of all sets of pairs of the form 
(Et? Tiesi s Eni Tnt 
with Ti,- .. , mn EIM, £1,... ,&n EV (variables of A) and x; Æ x; for i£ j. 
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(iii) The domain of a context I = {x1 : 71,...,@n : Tr} is defined by: 
dom(T) = {z1,... £n} 


We write z : T for {x : T} and T,I” for TUT” if dom(T) Ndom(I”) = {}. 


(iv) The range of a context I = {£1 : 71,...,@n : Tn} is defined by: 
IT| = {7 EH|(x:rT)ErT, for some z}. 
(v) The typability relation on C x A x II is defined by: 


Teco fF MET rF M:o>r TEN: 0 
T,e:tb 2:7 T+ At.M: 0-7 Tt MN:7 


where we require that x ¢ dom(T) in the first and second rule. 


(vi) The simply typed A-calculus \— is the triple (A,II,+). To distinguish 
between this system and variants, the present one will also be called 
simply typed -calculus à la Curry or just A> a la Curry. 


3.1.2. EXAMPLE. Let 0,7, p be arbitrary types. Then: 


(i) F Ata: o —> o; 


(ii) F Az.ày.z : o > T> 0; 


Gii) F Az.ày.àz.z z (y z): (9 >T > p)> (o >T)>0 >p. 


3.1.3. DEFINITION. If rT / M:o then we say that M has type o in T. We 
say that M € A is typable if there are I and ø such that T F M:o. 


The set of typable terms is a subset—in fact, a proper subset—of the set 
of all A-terms. In this subset, restrictions are made regarding which A-terms 
may be applied to other A-terms. 

Very informally, the type variables denote some unspecified sets, and 
a — T denotes the set of functions from ø to T. Saying that M has type 
o — 7 in IT then intuitively means that this set of functions contains the 
particular function that M informally denotes. For instance, F Agz.x : o —> c 
informally states that the identity function is a function from a certain set 
to itself. 

A context is an assumption that some elements 71,... ,2%p have certain 
types 01,... ,On, respectively. Moreover, if x has type o and M has type T 
then Ax.M has type ø — r. This reflects the intuition that if M denotes 
an element of 7 for each x in o, then Ax.M denotes a function from ø to T. 
In a similar vein, if M has type o — 7 and N has type ø, then M N has 
type T. 
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3.1.4. WARNING. The idea that types denote sets should not be taken too 
literally. For instance, if A and B are sets then the set of functions from 
A to A is disjoint from the set of functions from B to B. In contrast, if o 
and 7 are different simple types, then a single term may have both types, 
at least in the version of simply typed A-calculus presented above. 


Just like -calculus provides a foundation of higher-order functional pro- 
gramming languages like LISP and Scheme, various typed \-calculi provide 
a foundation of programming languages with types like Pascal, ML, and 
Haskell. Typed A-calculi are also of independent interest in proof theory as 
we shall have frequent occasion to see in these notes. 

We conclude this section with a brief review of some of the most funda- 
mental properties of A. The survey follows [8]. 

The following shows that only types of free variables of a term matter 
in the choice contexts. 


3.1.5. LEMMA (Free variables lemma). Assume that T F M:o. Then: 
(i) T CI’ implies T’ | M:o; 

(ii) FV(M) C dom(L); 

(iii) IY F M : øo where dom(I’) = FV(M) and I’ CT. 


PROOF. (i) by induction on the derivation of Tr F M : ø. As in [8] we 
present the proof in some detail and omit such details in the remainder. 


1. The derivation is 


A, xzx:oF xz: 
where IT = A,x: o, x ¢ dom(A) and M = x. Since IT C I” and I” 
is a context, IY = A’',x : o for some A’ with x ¢ dom(A’). Hence 
A’,x:o0 F «x:0, as required. 
2. The derivation ends in 
Drein APS 
rT F \@.P: 7, 3 7 


where x ¢ dom(T), € = m > 7%, and M = Ax.P. Without loss of 
generality we can assume that x ¢ dom(I”). Then T, g : 7 C I’, £: 7% 
so by the induction hypothesis I’,x : 7, F P : 7. Then we also have 
T F Axz.P : 7, > T, as required. 


3. The derivation ends in 
rH P:r=>o UF er 
[TF O 
where M = P Q. By the induction hypothesis (twice) I’ | P :T —> 0o 
and IY F Q:7, and then IY H P Q: ø, as required. 
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(ii)-(iii) by induction on the derivation of T F M :ø. oO 


The following shows how the type of some term must have been obtained 
depending on the form of the term. 


3.1.6. LEMMA (Generation lemma). 


(i) T F z:o impliesz:o €T; 
(ii) Tr F M N:o implies that there is ar such that T F M :T >o and 
TENET. 
(iii) T F Az.M : o implies that there are T and p such that T,x:Tr F M:p 
and o =T > p. 


PROOF. By induction on the length of the derivation. oO 


3.1.7. DEFINITION. The substitution of type T for type variable a in type o, 
written ola := T], is defined by: 


ala := 7] tg 
bla := T] = £B ifa# 
(01 > o2)[a:=7] = ala := rT] > ola := 7T] 


The notation T[a := 7| stands for the context {(x : ola := T|) | (£ :o) Er}. 


The following shows that the type variables range over all types; this is a 
limited form of polymorphism [90]; we will hear much more about polymor- 
phism later. The proposition also shows, similarly, that free term variables 
range over arbitrary terms. 


3.1.8. PROPOSITION (Substitution lemma). 
G) YT A M:øo, then Tja :=7] F M : ola := r7]. 
i) YT,x:r VE een? H Naa thenT F MeN oo 


PRooF. By induction on the derivation of T F M : ø and generation of 
T,x:r + M : ø, respectively. O 


The following shows that reduction preserves typing. 


3.1.9. PROPOSITION (Subject reduction). IT F M:o and M >g N, then 
TE N:o. 


Proor. By induction on the derivation of M —, N using the substitution 
lemma and the generation lemma. oO 
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3.1.10. REMARK. The similar property 

rF N:o& M> N>TFM:0 
is called subject expansion and does not hold in A—>, see Exercise 3.6.2. 
3.1.11. COROLLARY. IfT F M:o and M —>g N, then T F N:o. 


3.1.12. THEOREM (Church-Rosser property for typable terms). Suppose that 
Tr M:o. If M—geN and M —g N', then there exists an L such that 
N —g L and N'—>g L andT F L:o. 


PROOF. By the Church-Rosser property for A-terms and the subject reduc- 
tion property. o 


3.2. Simply typed -calculus à la Church 


As mentioned earlier, simply typed A-calculus was introduced by Curry [23] 
and Church [18]. More precisely, Curry considered types for combinatory 
logic, but his formulation was later adapted to -calculus [24]. 

There were several other important differences between the systems in- 
troduced by Church and Curry. 

In Curry’s system the terms are those of type-free A-calculus and the 
typing relation selects among these the typable terms. For instance, Ax.x is 
typable, whereas Ax.x x is not. 

In Church’s original system, the typing rules were built into the term 
formation rules, as follows. Let V, denote a denumerable set of variables for 
each ø € II. Then define the set A, of simply typed terms of type o by the 
clauses: 


x € Vs > «EAs 
M Eso & NEA > MNEA, 
M EA & teE€Ay =>  Az7.M E o>- 


The set of all simply typed terms is then taken as the union over all simple 
types o of the simply typed terms of type ø. 

Instead of assuming that the set of variables is partitioned into disjoint 
sets indexed by the set of simple types, we can use contexts to decide the 
types of variables as in the system à la Curry. Also, as in the system à 
la Curry, we can select the typable terms among a larger set. This yields 
the following, more common, formulation of simply typed A-calculus à la 
Church. 
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3.2.1. DEFINITION. 
(i) The set Ay of pseudo-terms is defined by the following grammar: 
An = V | (Av: I An) | (An An) 


where V is the set of (A-term) variables and II is the set of simple 
types.! We adopt the same terminology, notation, and conventions for 
pseudo-terms as for A-terms, see 1.3—1.10, mutatis mutandis. 


(ii) The typability relation Ik on C x Ay x I is defined by:? 


T,z:ot MeT TR M:ao-7 T N:o 


FLETE er [TH* Avio.M:0>7 TH MN: 


where we require that x ¢ dom(T) in the first and second rule. 


(iii) The simply typed A-calculus à la Church (A— à la Church, for short) 
is the triple (Aq, I, IF). 


(iv) ET -* M : o then we say that M has type o inT. We say that M € Aq 
is typable if there are I and o such that T H* M:o. 


3.2.2. EXAMPLE. Let 0,7, 9 be arbitrary simple types. Then: 


(i) K* Az:0.x : o —> 0; 


(ii) K* AT:o.Ay: T.z : 0 >T >; 


(iii) F* Axt:o—>rtT—>p.ày:o>rT.Az:0.(x z) y z : (o —>rT=>p)>(o—>T)>0—>p. 
Even with the formulation of A— à la Church in Definition 3.2.1 an 
important difference with A— à la Curry remains: in Church’s system ab- 
stractions have domains, i.e. are of the form Ax: 0.M, whereas in Curry’s 
system abstractions have no domain, i.e. are of the form Ax.M. Thus, in 
Church’s system one writes 
A£:0.£ : 0 > 0, 


whereas in Curry’s system one writes 


ALL: 0 —>O. 


'Strictly speaking, we should proceed as in the case of À-terms and define a notion of 
pre-pseudo-terms, then define substitution and a-equivalence on these, and finally adopt 
the convention that by M € Ay we always mean the a-equivalence class, see 1.13-1.19. 
We omit the details. 

?In this chapter it is useful to distinguish syntactically between typing in the system à 
la Church and the system à la Curry, and therefore we use H* here. In later chapters we 
shall also use + for H*. 
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The two different systems—Curry’s and Church’s—represent two differ- 
ent paradigms in programming languages. In Church’s system the program- 
mer has to explicitly write the types for all variables used in the program 
as in, e.g., Pascal, whereas in Curry’s approach the programmer merely 
writes functions, and it is then the job of the compiler or the programming 
environment to infer the types of variables, as e.g., in ML and Haskell. 

Having introduced a new set of terms (pseudo-terms instead of A-terms) 
we are obliged to introduce the notions of substitution, reduction, etc., for 
the new notion. This is carried out briefly below. We reuse much notation 
and terminology. 


3.2.3. DEFINITION. For M € Aq define the set FV(M) of free variables of M 
as follows. 


FV (x) = {x} 
FV(Az:o.P) = FV(P) Wr} 
FV(PQ) = FV(P)UFV(Q) 


If FV(M) = {} then M is called closed. 


3.2.4. DEFINITION. For M,N € Ay and z E V, the substitution of N for x 
in M, written M[x := N], is defined as follows: 


gS N] = 

yle := N] = y ifafy 

(P Qe =N] = Ple:= N] Qle:= N] 

Ato?) a= N] = ày:o.P|x := N] where xy and y ¢ FV(N) 


3.2.5. DEFINITION. Let —g be the smallest relation on Ay closed under the 
rules: 


P =>} P' => VYreV,ocIl: Ax:o.P >g Ax:0o.P' 
P =>} P' > YZEA: PO Sg PZ 
Baugr > WZEA: ZP ap P 


A term of form (Ar:a . P) Q is called a 8-redex, and P|x := Q] is called 
its G-contractum. A term M is a B-normal form if there is no term N with 
M >g N. 


3.2.6. DEFINITION. 


(i) The relation —> g (multi-step B-reduction) is the transitive-reflexive clo- 
sure of — 4g; 


(ii) The relation =g (G-equality) is the transitive-reflexive-symmetric clo- 
sure of >g. 
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We end the section by briefly repeating the development in the preceding 
subsection for simply typed A-calculus à la Church. 


3.2.7. LEMMA (Free variables lemma). Let T H* M:0. Then: 
(i) T CI” implies I’-* M : 0; 

(ii) FV(M) C dom(L); 

(iii) IY =* M : o where dom(I’) = FV(M) and T' CT. 


PROOF. See the Exercises. oO 


3.2.8. LEMMA (Generation lemma). 


(i) TH* x: impliesz:o EL; 
(ii) Tr-* M N : o implies that there is a T such that T F* M : T >o and 
r= Nor. 
(iii) T F* Az:T.M : o implies that there is a p such that T, x: T H* M: p 
and o =T > p. 


PROOF. See the Exercises. O 


3.2.9. PROPOSITION (Substitution lemma). 


(ij IFT Me, then Tja := T| H* Meola t= r7]. 
(ii) YT,x:rH* Meo andT H* N :rT then TD FP? ave N |e 6: 


PROOF. See the Exercises. oO 


3.2.10. PROPOSITION (Subject reduction). If rT F* M : o and M > N, 
then TH N:a. 


PROOF. See the Exercises. O 


3.2.11. THEOREM (Church-Rosser property). Suppose that T +* M : o. If 
M —>g8 N and M —>g N’, then there exists an L such that N—»g L and 
N'-»g L andTt* L:o. 


PROOF. One way to obtain this result is to repeat for Aq an argument 
similar to that we used for untyped terms, and then use the subject reduction 
property. Another method, based on so called logical relations can be found 
in [74]. oO 


The following two properties of simply typed A-calculus à la Church do 
not hold for the Curry system. Note that (ii) implies the subject expansion 
property—see Remark 3.1.10. 
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3.2.12. PROPOSITION (Uniqueness of types). 
(i) FT H* M:o andr =* M:7 theno =r. 
(ii) FT * M:o andr =* N:7 and M =g N, theno =r. 


PROOF. 
(i) By induction on M. 


(ii) If M =, N then by the Church-Rosser property, M —> g L and N—»g L, 
for some L. By subject reduction, T '* L :o and T H* L: 7. Now 
use (i). o 


It is easy to see that these properties fail in A— à la Curry. For instance, 
F Az.x:a— aand F Axa: (a@— a) > (a — a) by the derivations: 


x:aFr:a 


F àzxz:a—>a 


and 
x:acaF r:a>a 


F Az.x : (a>a) > (aa) 


Although these two derivations have the same structure, their conclusions 
are different due to different type assumptions for x. In contrast, if the 
Church term M has type o in I’, then there is exactly one derivation of this 
fact, which is uniquely encoded by M. 

This difference leads to some interesting problems for the Curry system. 
Given a term M which types can be assigned to M, if any? Is there a single 
best type in some sense? Such problems are studied in type inference, which 
we return to later. 

Because of the above difference, A— à la Curry and other similar systems 
are often called type assignment systems, in contrast to A> à la Church and 
similar systems which are called, e.g., typed systems. 


3.3. Church versus Curry typing 


Although the simply typed A-calculus à la Curry and Church are different, 
one has the feeling that essentially the same thing is going on. To some 
extent this intuition is correct, as we now show. 

Every pseudo-term induces a type-free A-term by erasing the domains of 
abstractions. 
3.3.1. DEFINITION. The erasure map |e | : Aq — A is defined as follows: 


lz] = z; 
|M] [N]; 
Ax.|M]. 


mos 
a 3 
Š> 
l 
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Erasure preserves reduction and typing: 
3.3.2. PROPOSITION (Erasing). Let M,N € An. 
(i) If M >, N then |M| —¢ |N]; 
(ii) FT K* M:o thenT + |M|:o. 
PROOF. (i) prove by induction on M that 
|M[x := N]| = |M|[x := |N]] (*) 


Then proceed by induction on the derivation of M —g N using (+). 
(ii) by induction on the derivation of T F* M:o. oO 


Conversely, one can “lift” every Curry derivation to a Church one. 


3.3.3. PROPOSITION (Lifting). For all M,N € A: 
(i) If M —, N then for each M' € An with |M'| = M there is N' € An 
such that |N'| = N, and M' >, N'; 
(ii) If[ + M : ø then there is an M' € An with |M'| = M andT +* M':o. 


PrRooF. By induction on the derivation of M >g N andr F M: 4a, 
respectively. oO 


3.3.4. WARNING. The above two propositions allow one to derive certain 
properties of Curry-style typable lambda-terms from analogous properties 
of Church-style typed lambda-terms, or conversely. For instance, strong 
normalization for one variant of (\ —) easily implies strong normalization 
for the other (Exercise 3.6.4). 

However, one has to be very cautious with such proof methods, some- 
times they do not work. A common mistake (cf. Exercise 3.6.5) is the 
following attempt to derive the Church-Rosser property for Church-style 
(A —) from the Church-Rosser property for untyped lambda-terms: 


Assume that Mo —g Mı and Mo —»g Mə. Then, by Propo- 
sition 3.3.2, we have |Mo| —»g |Mi| and |Mo| —g |M2|. By 
Church-Rosser property for untyped lambda-terms, we have a 
term P with |Mi| —»g P and |M2| —»g P. In addition, by the 
subject reduction property, P is typable into the desired type. It 
remains to apply Proposition 3.3.3, to obtain a Church-style term 
Ms with |M3| = P, and such that Mz —g M3 and Mı —>g M3. 


For an explanation why the gap in this argument cannot be easily fixed, and 
how it can be fixed, see [74, pp. 269, 559]. 


In the remainder, when stating properties of simply typed A-calculus it 
must always be understood that the result applies to both A— a la Curry 
and a la Church, except when explicitly stated otherwise. 
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3.4. Normalization 


In this section we are concerned with A— à la Church. 

A simple type can be regarded as a finite binary tree—this is where 
the alternative name “finite type” comes from—where all internal nodes are 
labeled by arrows and all leaves are labeled by type variables. We shall 
often refer to properties of types expressing them as properties of this tree 
representation. For instance, the function h(r) defined below is just the 
height of the corresponding tree. 


3.4.1. DEFINITION. Define the function A : II > N by: 


h(a) = 0 
h(rT—=c) = 1+max(h(rT),h(o)) 


It is often convenient to write Church style terms (typable pseudo-terms) 
in such a way that types of some or all subterms are displayed by super- 
scripts, as in e.g., (Ax:T.PP)" 7P R". Recall that a Church style term can be 
typed in only one way, provided the context of free variables is known. Thus 
our labelling is always determined by the term and the context. But the 
labelling itself is not a part of syntax, just a meta-notation. 

The following property is the first non-trivial property of A-. 


3.4.2. THEOREM (Weak normalization). Suppose T +* M : o. Then there 
is a finite reduction Mı >g Mz -g...— 8 Mn € NFg. 


PROOF. We use a proof idea due independently to Turing and Prawitz. 
Define the height of a redex (Ax:T.PP)R to be h(r — p). For M € Aq 
with M ¢ NFg define 


where 


h(M) = max{h(A) | A is a redex in M} 


and n is the number of redex occurrences in M of height h(M). If M € NFg 
we define h( M) = (0,0). 

We show by induction on lexicographically ordered pairs m(M) that if 
M is typable in A— a la Church, then M has a reduction to normal-form. 

Let TH M:o. If M € NFg the assertion is trivially true. If M ¢ NFg, 
let A be the rightmost redex in M of maximal height h (we determine the 
position of a subterm by the position of its leftmost symbol, i.e., the right- 
most redex means the redex which begins as much to the right as possible). 

Let M’ be obtained from M by reducing the redex A. The term M’ 
may in general have more redexes than M. But we claim that the number 
of redexes of height h in M’ is smaller than in M. Indeed, the redex A has 
disappeared, and the reduction of A may only create new redexes of height 
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less than h. To see this, note that the number of redexes can increase by 
either copying existing redexes or by creating new ones. Now observe that 
if a new redex is created then one of the following cases must hold: 


1. The redex A is of the form (Am:7. ...£ PP ... )(Ay?.Q”)", where T = 
p — u, and reduces to ... (Ay?.QH)P? .... There is a new redex 
(Ay?.Q")PP of height h(t) < h. 


2. We have A = (Az:7.Ay:p.R"“)P™, occurring in the context A?~#@Q?. 
The reduction of A to Ay:p.Ri', for some R, creates a new redex 
(Ay:p.R1)Q? of height h(p > u) < h(t = p> u) =h. 


3. The last case is when A = (Az:7.x)(Ay?.P"), with T = p > p, and 
it occurs in the context ATQ’. The reduction creates the new redex 
(Ay?.P#) QP? of height h(T) < h. 


The other possibility of adding redexes is by copying. If we have A = 
(Ax:7.P’)Q*, and P contains more than one free occurrence of x, then all 
redexes in Q are multiplied by the reduction. But we have chosen A to be 
the rightmost redex of height h, and thus all redexes in Q must be of smaller 
heights, because they are to the right of A. 

Thus, in all cases m(M) > m(M'), so by the induction hypothesis M’ 
has a normal-form, and then M also has a normal-form. oO 


In fact, an even stronger property than weak normalization holds: if 
H* M : ø, then no infinite reduction Mı —>g M2 —, ... exists. This 
property is called strong normalization and will be proved later. 

The subject reduction property together with the Church-Rosser prop- 
erty and strong normalization imply that reduction of any typable A-term 
terminates in a normal form of the same type, where the normal form is 
independent of the particular order of reduction chosen. 


3.5. Expressibility 


As we saw in the preceding section, every simply typable A-term has a 
normal-form. In fact, one can effectively find this normal-form by repeated 
reduction of the leftmost redex. (These results hold for both the a la Curry 
and a la Church system.) Therefore one can easily figure out whether two 
simply typable terms are G-equal: just reduce the terms to their respective 
normal-forms and compare them. 

These results should suggest that there will be difficulties in represent- 
ing all the partial recursive functions and possibly also the total recursive 
functions by simply typable A-terms, as we shall now see. In the rest of this 
section we are concerned with simply typed A-calculus a la Curry. 
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3.5.1. DEFINITION. Let 
int = (a > a) > (a > a) 


where a is an arbitrary type variable. A numeric function f : N” — N is 
A—-definable if there is an F € A with F F : int > --- — int — int 
(n+ 1 occurrences of int) such that 


F Cny +++ Cnm =B Cf(ny,... Nnm) 


for all n1,...,%m E N. 


It is natural to investigate which of the constructions from Chapter 1 
carry over to the typed setting. This is carried out below. 


3.5.2. LEMMA. The constant and projection functions are \A—-definable. 


PROOF. See the Exercises. oO 


3.5.3. LEMMA. The function sg : N > N defined by sg(0) = 0, sg(m+1) = 1 
is A—>-definable. 


PROOF. See the Exercises. O 


3.5.4. LEMMA. Addition and multiplication are \—>-definable. 


PROOF. See the Exercises. oO 


3.5.5. DEFINITION. The class of extended polynomials is the smallest class 
of numeric functions containing the 
(i) projections: U™ (n1,... Nnm) = ni for all 1 < i < m; 
(ii) constant functions: k(n) = k; 
(ii) signum function: sg(0) = 0 and sg(m +1) = 1. 
and closed under addition and multiplication: 
(i) addition: if f : N! — N and g : N! — N are extended polynomials, then 
so is (f + g) : NEY! GN 
(f +6) Gig 3s nk; Migs tos Mp = Fis ote ons , Mı) 
(ii) multiplication: if f : N€ + N and g : N! > N are extended polynomials, 
then so is (f - g) : NEH! 4 N 
(f-g)(m1,-.. nk Mi,- m) = f(r... ng): gM,- ,m) 
3.5.6. THEOREM (Schwichtenberg). The A> -definable functions are exactly 


the extended polynomials. 


The proof is omitted. One direction follows easily from what has been 
said already; the other direction is proved in [97]. 

If one does not insist that numbers be uniformly represented as terms of 
type int, more functions become \—>-definable—see [35]. 
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3.6. Exercises 


3.6.1. EXERCISE. Show that the following A-terms have no type in à> a la 
Curry. 


LATE T 
2. Q 

3. KIQ; 
4. Y: 

5. co K. 


3.6.2. EXERCISE. Find terms M and M’ and types o, 0’ such that F M : ø, 
t M':0', M—»g M', and not H M: ø. 


3.6.3. EXERCISE. Is the following true? If M —g N (where M,N € A) and 
M', N' € Aq are such that |M'| = M, |N'| = N then M' >, N'. 


3.6.4. EXERCISE. Show that strong normalization for (A —) à la Curry im- 
plies strong normalization for (A —) à la Church, and conversely. 


3.6.5. EXERCISE. Find the bug in the example argument in Warning 3.3.4. 


3.6.6. EXERCISE. Consider the proof of weak normalization. Assume that 
a given term M is of length n including type annotations. Give a (rough) 
upper bound (in terms of a function in n) for the length of the normalizing 
sequence of reductions for M, obtained under the strategy defined in that 
proof. Can your function be bounded by exp;(n), for some k? Can this be 
done under the assumption that the height of redexes in M is bounded by 
a given constant h? (Here, expo(n) = n and expp41(n) = 2°7Pk (n) .) 


3.6.7. EXERCISE. This exercise, and the next one, are based on [35]. Define 
the rank of a type T, denoted rk(r), as follows: 


rk(a) = 0 
rk(rT—0o) = max(h(T)+1,h(0)) 


Alternatively, we have 
rk(t] 3 +++ —> T > a) = 1+ max(h(7),...,A(tm)). 


The rank of a redex (Au:7.P?)R is rk(r — p). Then define the depth of a 
term M, denoted d(M), by the conditions 


d(x) = 0; 
d(MN) = 1+max(d(M),d(N)); 
d(Ar:o.M) = 1+d(M). 
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Let r be the maximum rank of a redex occurring in M, and let d(M) = d. 
Show (by induction w.r.t M) that M can be reduced in at most 2% — 1 steps 
to a term Mı such that the maximum rank of a redex occurring in M; is at 
most r — 1, and d(M;) < 2%. 


3.6.8. EXERCISE. Let r be the maximum rank of a redex occurring in M, 
and let d(M) = d. Use the previous exercise to prove that the normal form 
of M is of depth at most exp,(d), and can be obtained in at most exp,(d) 
reduction steps. 


3.6.9. EXERCISE. Show that the constant functions and projection functions 
are A—>-definable. 


3.6.10. EXERCISE. Show that sg is \—-definable. 


3.6.11. EXERCISE. Show that addition and multiplication are A—-definable. 
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CHAPTER 4 


The Curry-Howard isomorphism 


Having met one formalism for expressing effective functions—A-calculus— 
and another formalism for expressing proofs—natural deduction for intu- 
itionistic logic—we shall now demonstrate an amazing analogy between the 
two formalisms, known as the Curry-Howard isomorphism. 

We have already seen several hints that effective functions and proofs 
should be intimately related. For instance, as mentioned in Chapter 2, 
the BHK-interpretation [17, 53, 63] states that a proof of an implication 
pı — p2 is a “construction” which transforms any proof of pı into a proof 
of p2. What is a construction? A possible answer is that it is some kind 
of effective function. There are several ways to make this answer precise. 
In this chapter we present one such way; another one is given by Kleene’s 
realizability interpretation, which we present later. 


4.1. Natural deduction without contexts 


Recall that Chapter 2 presented a so-called natural deduction formulation 
of intuitionistic propositional logic. Such systems were originally introduced 
by Gentzen [39]. More precisely, Gentzen introduced two kinds of systems, 
nowadays called natural deduction systems and sequent calculus systems, 
respectively. In this chapter we are concerned with the former kind; sequent 
calculus systems will be introduced in the next chapter. 

One of the most significant studies of natural deduction systems after 
Gentzen’s work in the 1930s appears in Prawitz’ classical book [85], which 
is still very readable. 

There is an informal way of writing natural deduction proofs. Instead of 
maintaining explicitly in each node of a derivation the set of assumptions on 
which the conclusion depends (the context), one writes all the assumptions 
at the top of the derivation with a marker on those assumptions that have 
been discharged by the implication introduction rule. 
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Since this style is quite common in the proof theory literature—at least 
until the Curry-Howard isomorphism became widely appreciated—we also 
briefly review that notation informally here. Another reason for doing so, is 
that the notation displays certain interesting problems concerning assump- 
tions that are hidden in our formulation of Chapter 2. 

Consider the proof tree: 


(p> vw) Aly = p) (p> wv)A(y—p) 
g ery p g>p 
Y p 
Prp 


First note that, as always, the proof tree is written upside-down. The leaves 
are the assumptions, and the root is the conclusion, so the proof tree demon- 
strates that one can infer ~ A^ p from ọ and (y — 4) A (Y > p). 

As usual there is an —-introduction rule which discharges assumptions. 
Thus we are able to infer y — 4Y A^ p from (Y — w) A(y > p). Notationally 
this is done by putting brackets around the assumption in question which 
is then called closed, as opposed to the other assumptions which are called 
open: 


(p> YAY p) (p> PAY?) 
[p] g> yp [y] pp 
Y p 
wp 
proprp 


Note that the above step discharges both occurrences of y. In general, in an 
—-introduction step, we may discharge zero, one, or more occurrences of an 
assumption. 

Taking this one step further we get 


Ke > WAY = p) (y= v) Ale p)] 
[¢] go [p] yp 
Y p 
Prp 
g>yprp 


(powAlerp)reryAp 


Since we may decide to discharge only some of the occurrences of an open 
assumption in an —-introduction step, one sometimes adopts for readability 
the convention of assigning numbers to assumptions, and one then indicates 
in an —-introduction step which of the occurrences where discharged. In 
the above example we thus might have the following sequence of proof trees. 
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First: 
(p> ¥) A (py = p)” (yp > ¥) A (py = p)” 
p ev gt) ep 
Y p 
prp 


Then by closing both occurrences of y: 


(py > ) A(y > p) (py > p) A(y > p) 
[yg] ep [ye] yp 
Y p 
wAp 
gown ph 


And by closing both occurrences of (p > Y) A (y > p): 


(vy > P) A (y = py] Ke > pale = p 
[k] ® p> A yp 
Y p 
PNP 
p> prp 


(p> p) l> oyp PAP?) 


It is interesting to note that the notation where we indicate which as- 
sumption is discharged allows us to distinguish between certain very similar 
proofs. For instance, in 


(CEN (CEN = p)]® 
[k] ® p> A yp 
Y p 
PNP 
yop ph 


(y= PAV Pp) PHVA PY 
(pov) ^ le = p) (GP oYVAY > DAE YA PH 


and 
(yp 3 ¥v) A (py = p)|® [(y = vd) A(y = p)]® 
[ye] yp [yg] ep 
Y p 
wp 
p> bn ph 


(pov) Ae > p) 99> PA Pp?) 
(ps pale > pA = (PIV A(Y> PD) FES LA Pp? 
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we discharge the two occurrences of (p — p) A (p — p) separately, but in 
different orders. 
Similarly, 
[a] 
ge 
p> p> p” 


and 
A 
p = p®) 
yy pt) 


are two different proofs of y —> p — y. In the first proof there is first a 
discharge step in which the single occurrence of ọ is discharged, and then a 
discharge step in which zero occurrences of y are discharged. In the second 
proof the order is reversed. 

In order to avoid confusion with assumption numbers, we require that if 
two assumptions y and ~w have the same number, then y and w are the same 
formula. Also, when we discharge the assumptions with a given number (i), 
we require that every assumption with this number actually occur on a 
branch from the node where the discharging occurs. 

In general, the rules for constructing the above proof trees look as follows. 


p wv pry ery 
pry p Y 
[el [vy] 
p Y CNA p 
eve eve pn 
[el 
Y p>yY e 
p> yO Y 
sL 
p 


For instance, the upper left rule (^-introduction) states that two proof 
trees ending in roots y and w, respectively, may be joined into a single proof 
tree by addition of a new root y Aw with the former roots as children. The 
—-introduction rule states that one may infer an implication by discharging 
the assumptions with the label indicated by the step. 
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As we shall see later in this chapter, there is an interest in proofs of a 
certain simple form. One arrives at such proofs from arbitrary proofs by 
means of proof normalization rules that eliminate detours in a proof. More 
concretely, consider the proof tree: 


[yg] [p] 
ya ep) yy 
(po p) n> y) 
yo 


The proof tree demonstrates that y — y is derivable. However, it does 
so by first showing y — y, then inferring (p —> p) A (Y — y), and then, 
finally, concluding y — y. A more direct proof tree, which does not make 
an excursion via (y > p) A (Y > y) is: 


[yg] 
yo) 


Note that the detour in the former proof tree is signified by an intro- 
duction rule immediately followed by the corresponding elimination rule, 
for example /-introduction and /-elimination. In fact, the above style of 
detour-elimination is possible whenever an introduction rule is immediately 
followed by the corresponding elimination rule. 


As another example, consider the proof tree: 


[yp = yg 
[y] pp pP 
y = y®) ly > p) > Y > p — p” 
p> g> ge 


Here we infer y > y — ọ from ọ > ọ and (y > y) > Y4 > Yy > ọ. 
The proof of the latter formula proceeds by inferring yY — y — ọ from the 
assumption y — y. Since we can prove this assumption, we could simply 
take this proof and replace the assumption y — y with the proof of this 
formula: 


[yg] 
p > y®) 


poy oe) 


In general one considers the following proof normalization rules (sym- 
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metric cases omitted): 


£ II 
yb 
pry x 
9 > p 
[py] 

II £ 
X p p 

Y pp) TI 

p > p 
B [al CIK K 

p 2 H p 

pV y p p x 

pes) ee 


The first rule states that if we, somewhere in a proof, infer y and w and then 
use A-introduction to infer y A w followed by /A-elimination to infer y, we 
might as well avoid the detour and replace this proof simply by the subproof 
of y. 


The second rule states that if we have a proof of y from assumption p 
and we use this and —-introduction to get a proof of p — y, and we have 
a proof of w then, instead of inferring y by —-elimination, we might as well 
replace this proof by the original proof of y where we plug in the proof of w 
in all the places where the assumption w occurs. 


The reading of the third rule is similar. 


The process of eliminating proof detours of the above kind, is called 
proof normalization, and a proof tree with no detours is said to be in normal 
form. Another similar process, called cut elimination, eliminates detours in 
sequent calculus proofs whereas proof normalization eliminates detours in 
natural deduction proofs. Sequent calculus systems are introduced in the 
next chapter. 


Proof normalization and cut elimination were studied in the 1930s by 
Gentzen, and his studies were continued by several researchers, perhaps most 
importantly by Prawitz in [85]. Nowadays, proof theory is an independent 
discipline of logic. 


In these notes we shall not consider natural deduction proofs in the above 
style any further. 
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4.2. The Curry-Howard isomorphism 


We could introduce reductions a la those of the preceding section for the 
natural deduction formulation of Chapter 2, but we shall not do so. The 
rules for that formulation are rather tedious (try the rule for —!). It would 
be more convenient to have each proof tree denoted by some 1-dimensional 
expression and then state transformations on such expressions rather than 
on proof trees. It happens that the terms of the simply typed A-calculus are 
ideal for this purpose, as we shall see in this section. 

We show that any derivation in intuitionistic propositional logic corre- 
sponds to a typable A-term a la Church, and vice versa. More precisely we 
show this for the implicational fragment of intuitionistic propositional logic. 

Recall from Section 2.6 that the implicational fragment is the subsystem 
in which the only connective is — and in which the only rules are (> E) 
and (— I). This fragment is denoted IPC(—). The whole system is denoted 
IPC(—, A, V,L) or plainly IPC. 

If we take PV (the set of propositional variables) equal to U (the set of 
type variables), then ® (the set of propositional formulas in the implicational 
fragment of intuitionistic propositional logic) and II (the set of simply types) 
are identical. This will be used implicitly below. 


4.2.1. PROPOSITION (Curry-Howard isomorphism). 
(i) YT + M: ¢ then |T| + g.t 
(ii) ST + ọ then there exists M € Ay such that A F M : y, where 
A= {(tp: 9) |g ET}. 
PROOF. (i): by induction on the derivation of T F M: y. 
(ii): by induction on the derivation of T F y. Let A= {xy : y|y ET}. 
1. The derivation is 
Trek g 
We consider two subcases: 
(a) p ET. Then A F ayo. 
(b) y gT. Then A, zy: p F Tọ: Y. 


2. The derivation ends in 


TH y> Thy 
TF de 


By the induction hypothesis A F M:y—wandA F N: yg, and 
then also AF MN: w. 


‘Recall that |I| denotes the range of I. 
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3. The derivation ends in 


T, F wo 
TF ọo>y 


We consider two subcases: 


(a) €T. Then by the induction hypothesis A F M : w. By 
Weakening (Lemma 3.19(i)) A,x : y F M : ẹ¢, where x ¢ 
dom(A). Then also A F At:9.M: py. 


(b) p T. Then by the induction hypothesis A, zy : p F M : 4% and 
then also A F Aty:y.M:yp—y. oO 


4.2.2. REMARK. The correspondence displays certain interesting problems 
with the natural deduction formulation of Chapter 2. For instance 


r:p,y:pF r:e 
xz: F Ay:p.2: pry 
F àz:g . Ayip. T:> yoy 


and 
L: P, y: pF y: 
z:o F Ayp. y: pry 
F àz: .\y:p.y:p> y> ye 


are two different derivations in A— showing that both Az: . Ay:y . x and 
At:p.rAy:y.y have type y > py > ọ. 
Both of these derivations are projected to 


pry 
pryprye 
Fp>p>y 


This reflects the fact that, in the natural deduction system of Chapter 2, one 
cannot distinguish proofs in which assumptions are discharged in different 
orders. Indeed, A— can be viewed as an extension of [PC(—) in which 
certain aspects such as this distinction are elaborated. 


The correspondence between derivations in IPC(—) and \— can be 
extended to the whole system IPC by extending the simply typed A-calculus 
with pairs and disjoint sums. One extends the language Ay with clauses: 


Nae Se: | < An, An > | mı(An) | T(r) 
| inf? (An) | ind’? (An) | case(An; VAn; V.An) 
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and adds typing rules: 


TEM:y TEN:¢ TE M:yAp TE M:vApg 
TF<M,N>:pAgQ T+ m(M):y~ T+ m(M): Y 
TrEM:wy rF FM: 
rF inf? (M): Yve rF ing (M): Yve 


TF L:yVvgy Tx: yFM:pŅş Tyy:gt Nip 
Tr F case(L;2.M;y.N) : p 


and reduction rules: 


Tı(< Mı, Me >) —> M 
T2(< Mı, Mo >) — Mə 


case(inf(N);2.K;y.L) —> K{zx:= N} 
case(ing(N);2.K;y.L) — L{y:= N} 


Intuitively, 6A 4% is a product type, so < Mı, M2 > is a pair, and mı (M) 
is the first projection. In type-free à-calculus these could be defined in terms 
of pure A-terms (see Proposition 1.46), but this is not possible in A>. This 
is related to the fact that one cannot define conjunction in IPC in terms of 
implication (contrary to the situation in classical logic, as we shall see later). 

In the same spirit, 6 V w is a sum (or “variant”) type. A sum type is 
a data type with two unary constructors. Compare this to the data type 
“integer list”, which is usually defined as a data type with two constructors: 
the 0-ary constructor Nil and the 2-ary constructor Cons(e, e) which takes a 
number and a list of numbers. In a sum we have the two unary constructors 
left and right injection. 

Thus case(M; x.K;y.L) is a case-expression which tests whether M has 
form in?(N) (and then returns K with N for x) or ing(N) (and then re- 
turns L with N for y), just like in a functional programming language 
we could have a case-expression testing whether an expression is Nil or 
Cons(n, ns). 

Thus, uses of the axiom of intuitionistic propositional logic are reflected 
by variables in the term, uses of the —-elimination rule correspond to ap- 
plications, and uses of the —-introduction rule correspond to abstractions. 

In fact, we can view A— as a more elaborate formulation of IPC(—) 
in which the terms “record” the rules it was necessary to apply to prove 
the type of the term, when we view that type as a proposition. For in- 
stance, Az: . x has type y — y, signifying the fact that we can prove 
y — ọ by first using the axiom recorded by the variable x and then using 
—-introduction, recorded by Ax : y. In short, in A— viewed as a logic, 
the terms serve as a linear representation of proof trees, and are usually 
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called constructions [58]. These are also constructions in the sense of the 
BHkK-interpretation: a construction of p — w is a A-term Ax: . M of type 
py. 

Two different propositions cannot have the same construction, since we 
work with Church terms. In contrast, several constructions may correspond 
to the same proposition. This is because the same proposition may be proven 
in different ways. 

Thus \— and IPC(—) may be viewed as different names for essentially 
the same thing. This means that each of the concepts and properties con- 
sidered in A makes sense in IPC(—) and vice versa. 

As mentioned, terms in A— correspond to constructions in IPC(—). 
Types correspond to formulas, type constructors (sum and pair) to connec- 
tives. Asking whether there exists a term of a given type (inhabitation), 
corresponds to asking whether there exist a construction for a given propo- 
sition (provability.) Asking whether there exists a type for a given term 
(typability), corresponds to asking whether the construction is a construc- 
tion of some formula. 

What is a redex in a construction? Well, each introduction rule intro- 
duces a constructor (a lambda, a pair, or an injection) in the construction, 
and each elimination rule introduces a destructor (an application, a projec- 
tion, or a case-expression). Now, a redex consists of a constructor imme- 
diately surrounded by the corresponding destructor. Therefore a redex in 
the construction represents a proof tree containing an application of an in- 
troduction rule immediately followed by an application of the corresponding 
elimination rule; this was what we called a detour in a proof tree. Therefore, 
reduction on terms corresponds to normalization of constructions. A term 
in normal form corresponds to a construction representing a proof tree in 
normal form. The subject reduction proposition states that reducing a con- 
struction of a formula yields a construction for the same formula. The 
Church-Rosser Theorem states that the order of normalization is immate- 
rial. Also, it states that we managed to identify essentially identical proofs 
without identifying all proofs. 
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In summary: 


A> IPC(—) 
term variable assumption 
term construction (proof) 
type variable propositional variable 
type formula 
type constructor connective 
inhabitation provability 
typable term construction for a proposition 
redex construction representing proof tree with redundancy 
reduction normalization 
value normal construction 


4.2.3. EXAMPLE. Consider the following example deduction containing re- 
dundancy. The original derivation with constructions is: 


Lipr eip 
F ATP. L:~p 7H 


The complicated proof with constructions is: 


y:p HF yip r:pr-a:9 
F Ayy. y: wow F Az:iy.z: Yy >Y 
E< Ax:g. z, Ayy. y>: (p> p n>) 
H ml< àz:g . x, ày: Y. y>): pry 


The construction of the latter proof tree in fact contains a redex which upon 
reduction yields the construction of the former proof tree. 


The perfect correspondence between reduction and normalization and 
the related concepts, justifies the name “isomorphism” rather than simply 
“bijection.” In fact, reduction has been studied extensively in the A-calculus 
literature, while normalization has been studied independently in proof the- 
ory. 

Since the “discovery” of the isomorphism, the two worlds have merged, 
and some authors feel that it is exactly in the correspondence between reduc- 
tion and normalization that the isomorphism is deepest and most fruitful. 
This point of view is supported by the fact that some typed A-calculi have 
been introduced as means of studying normalization for logics, most notably 
Girard’s System F introduced in his work [44] from 1971. System F corre- 
sponds to second order minimal propositional logic and will be discussed in 
Chapter 12. 
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As an appealing illustration of the isomorphism and an appropriate con- 
clusion of this section, this system was independently invented at roughly 
the same time in computer science by Reynolds [90] in his study of poly- 
morphism in typed functional programming languages. 

In the remainder of these notes the concepts corresponding to one an- 
other under the isomorphism are used interchangeably. In particular, any 
system as that of the preceding subsection will be called both a logic and a 
A-calculus depending on the aspects being emphasized. 


4.3. Consistency from normalization 


A number of properties regarding unprovability can be difficult to establish 
directly, but more easy to establish by semantical methods as we saw in 
Chapter 2. Often these semantical methods can be replaced by methods 
involving the weak normalization property. 

The following shows that IPC(—) is consistent. 


4.3.1. PROPOSITION. ù% L. 


PROOF. Assume that F L. Then | M: L for some M € Aq. By the weak 
normalization theorem and the subject reduction theorem there is then an 
N €NFg such that F N: 1. 

Now, A-terms in normal form have form x N1 ... Nm (where N1,... , Nn 
are normal-forms) and Ar:o . N’ (where N’ is in normal form). We cannot 
have N of the first form (then x € FV(N), but since F N : L, FV(N) = {}). 
We also cannot have N of the second form (then L = ø — 7 for some o,T 
which is patently false). oO 


4.4. Strong normalization 


As suggested by the application in the preceding section, the weak normal- 
ization property of A— is a very useful tool in proof theory. In this section 
we prove the strong normalization property of A— which is sometimes even 
more useful. 

The standard method of proving strong normalization of typed A-calculi 
was invented by Tait [104] for simply typed \-calculus, generalized to second- 
order typed A-calculus by Girard [44], and subsequently simplified by Tait [105]. 

Our presentation follows [8]; we consider in this section terms à la Curry. 


4.4.1. DEFINITION. 


(i) SNg = {M € A | M is strongly normalizing }. 
(ii) For A,B C A, define A> B={FEA|Vac A: Fae B}. 
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(iii) For every simple type ø, define [øo] C A by: 
[a] = SN 
[o=] = [ol > [7] 
4.4.2. DEFINITION. 
(i) A set X C SNg is saturated if 
1. For all n > 0 and Mj,... Mn E SNg: 
x Mı... Mn E X 
2. For all n > 1 and Mj,...,Mn E SNg: 
Mo{x = Mı} Mə... Mp E X => (Ax. Mo) Mı Mə... Mn E X 
(ii) S=4{X CA| X is saturated }. 
4.4.3. LEMMA. 
(i) SNg € S; 
(ii) AABES=> A-BeES; 
(iii) o eN > [o] €S. 
PROOF. Exercise 4.6.3. O 


4.4.4. DEFINITION. 


(i) a valuation is a map p: V — A, where V is the set of term variables. 


The valuation p(x := N) is defined by 


N ifr@=y 
p(y) otherwise 


ple s= No) = { 


(ii) Let p be a valuation. Then [M], = M{a1 := p(21),... , £n := p(tn)}, 


where FV(M) = {21,... ,2n}. 


(iii) Let p be a valuation. Then p = M : o iff [M], € [o]. Also, p ET iff 


p(x) € fo] for all z : o Er. 
(iv) PE M:oifYp:pHT > pEM:o. 


4.4.5. PROPOSITION (Soundness). T  M:o >T H M:o. 


PROOF. By induction on the derivation of T F M:o. 


1. The derivation is 
TkF-a:o e«:o0€T 


If p ET, then [z], = p(x) € [o]. 
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2. The derivation ends in 


T+ M:o->7r TF N:0 
TE EMN:T 


Suppose p } T. By the induction hypothesis T = M : o — 7 and 
TE N:0o,sop=M:0o—>rTandpHN: o, i.e., [M], € lo] - [7] 
and [N], € [o]. Then [M N], = [M], [N]p € [7], as required. 


3. The derivation ends in 


T, z:o fF M:T 
T+ àz M:o—>rT 


Suppose p = T. Also, suppose N € [o]. Then p(x := N) HT, : o. 
By the induction hypothesis T,x : o = M : r, so p(v:=N)EM:7 
i.e., [M]pæ:=m) € [r]. Now, 


[As.M] N = (Az.M) {yr = ply), -Yn = Plyn) N 
> M{y1 := p(y), -- Yn = Plyn) t= N} 
= [M] e:=N) 
Since N € [o] © SNg and [M]ye:=n) € [7] € S, it follows that 
[Avz.M], N € [r]. Hence [Ar.M], € [o > 7]. oO 


4.4.6. THEOREM. T F M:o0 => M €E SNo. 


Proor. Ffr F M:o, then T = M: ø. For each z : 7 ET, let 
p(x) = x. Then z € [r] holds since [7] € S. Then p } T, and we have 
M = [M] € [o] € SNo. oO 


The reader may think that the above proof is more complicated than the 
weak normalization proof of the preceding chapter; in fact, this feeling can 
be made into a technical property by noting that the latter proof involves 
quantifying over sets, whereas the former does not. 

The fact that the strong normalization property seems more difficult to 
prove has led to some techniques that aim at inferring strong normalization 
from weak normalization—see [102]. 

There are many applications of strong normalization, but many of these 
applications can be obtained already by using the weak normalization theo- 
rem. The following is a true application of strong normalization where weak 
normalization does not suffice. 


4.4.7. DEFINITION. Let — be a binary relation on some set L, and write 
M — M' if M = Mı > ... — Mn = M’, where n > 1. Then 


1. — satisfies CR iff for all Mı, M2, M3 E€ L, Mı —> Mə and Mı —> M3 
implies that there is an M4 € L such that Mə — M4 and M3 —> M4. 
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2. — satisfies WCR iff for all M,, M2, M3 € L, Mı —> Mo and Mı — M3 
implies that there is an M4 € L such that Mə —> M4 and M3 —> M4. 


3. — satisfies SN iff for all M € L, there is no infinite reduction sequence 
M = M'—.... 


4. — satisfies WN iff for all M € L, there is a finite reduction sequence 
M — M' =... — M” such that M” is a normal form (i.e., for all 
N €L: M" AN). 


4.4.8. PROPOSITION (Newman’s lemma). Let — be a binary relation satis- 
fying SN. If — satisfies WCR, then — satisfies CR. 


PROOF. See the exercises. O 


The following shows that the assumption about strong normalization 
cannot be replaced by weak normalization. 


4.4.9. PROPOSITION. There is a binary relation — satisfying WN and WCR, 
but not CR. 


PROOF. See the exercises. oO 


4.4.10. COROLLARY. Let Mı € A be typable in A—> à la Church and assume 
that Mı >g M2 and Mı —>8 M3. Then there is an M4 such that Mz—»g M4 
and M3 —>8 Ma. 


PROOF. See the exercises. O 


4.5. Historical remarks 


The informal notion of a “construction” mentioned in the BHK-interpretation 
was first formalized in Kleene’s recursive realizability interpretation [60, 61] 

in which proofs in intuitionistic number theory are interpreted as numbers, 

as we will see later in the notes. A proof of yı — wg is interpreted as the 

Gödel number of a partial recursive function mapping the interpretation of 
any proof of yı to the interpretation of a proof of yo. 

One can see the Curry-Howard isomorphism—the correspondence be- 
tween systems of formal logic and functional calculi with types, mentioned 
above—as a syntactic reflection of this interpretation. It shows that a cer- 
tain notation system for denoting certain recursive functions coincides with 
a system for expressing proofs. 

Curry [24] discovered that the provable formulas in a so-called Hilbert 
formulation of IPC(—) coincide with the inhabited types of combinatory 
logic, when one identifies function type with implication. Moreover, every 
proof in the logic corresponds to a term in the functional calculus, and 
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vice versa. Curry also noted a similar correspondence between a natural 
deduction formulation of IPC(—) and simply typed A-calculus, and between 
a sequent calculus formulation of IPC(—) and a sequent calculus version of 
simply typed A-calculus. 

Gentzen’s Hauptsatz [39] shows how one can transform a sequent cal- 
culus proof into another proof with no applications of the cut rule. Curry 
now proved a corresponding result for the sequent calculus version of simply 
typed A-calculus. He then formulated correspondences between sequent cal- 
culus systems, natural deduction systems, and Hilbert systems (in terms of 
the corresponding functional calculi) and used these to infer weak normal- 
ization for G-reduction in simply typed A-calculus and for so-called strong 
reduction in combinatory logic. 

A more direct relation between reduction on terms and normalization 
of proofs was given by Howard in a paper from 1968, published as [58]. 
Prawitz had studied reduction of natural deduction proofs extensively [85]— 
seven years after Curry’s book—and had proved weak normalization of this 
notion of reduction. Howard now showed that reduction of a proof in the 
natural deduction system for minimal implicational logic corresponds to ø- 
reduction on the corresponding term in the simply typed A-calculus. He also 
extended this correspondence to first order intuitionistic arithmetic and a 
related typed A-calculus. 

Howard’s correspondence and the weak normalization theorem give a 
syntactic version of Kleene’s interpretation, where one replaces recursive 
functions by A-terms in normal form. For instance, any proof of yi — ye 
reduces to a A-abstraction which, when applied to a proof of y1, yields a 
proof of p2. 

Constable [19, 20] suggested that a type or proposition y be viewed as a 
specification, and any proof M of y as a program satisfying the specification. 
For instance, sorting can be specified by the formula 


Va Jy : ordered(y) A permutation(2, y) 


in predicate logic, and a proof of the formula will be a sorting algorithm. 
There is a literature devoted to methods for finding efficient programs in 
this way. 

The Curry-Howard isomorphism has evolved with the invention of nu- 
merous typed A-calculi and corresponding natural deduction logics, see [87, 
55, 8, 41]. Other names for the isomorphism include propositions-as-types, 
formula-as-types, and proofs-as-programs. 


4.6. Exercises 


4.6.1. EXERCISE. Give derivations of the formulas (1),(3),(5),(7),(9),(11) from 
Section 2.2 using the natural deduction style of Section 4.1. 
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4.6.2. EXERCISE. Give A-terms corresponding to the derivations from Exer- 
cise 4.6.1. Use the following rule for A-terms corresponding to the ex-falso 


rule: 
TEM:L 


oe (Vie. 


4.6.3. EXERCISE. Prove Lemma 4.4.3. 


4.6.4. EXERCISE. 
1. Prove Newman’s Lemma. 


Hint: Prove by induction on the length of the longest reduction se- 
quence from M that M —> Mı and M —» Mə implies that there is 
an M3 such that Mı — Mz and Mə —> M3. 


2. Prove Proposition 4.4.9. 
3. Infer from Newman’s Lemma Corollary 4.4.10. 
4.6.5. EXERCISE. Prove Proposition 4.2.1(i) in detail. 


4.6.6. EXERCISE. A (-reduction strategy is a map F : A — A such that 
M —. F(M) if M ¢ NFg, and F(M) = M otherwise. Informally, a reduc- 
tion strategy selects from any term not in normal form a redex and reduces 
that. For example, fF; is the reduction strategy that always reduces the 
left-most redex. 

A reduction strategy F is normalizing if, for any weakly normalizing 
term M, there is an i such that? 


M >, F(M) -,...—¢ F*(M) € NFg 


That is, if the term has a normal form, then repeated application of F 
eventually ends in the normal form. A classical result due to Curry and 
Feys states that F; is normalizing. 

A reduction strategy F is perpetual if, for any term M which is not 
strongly normalizing, there is no 7 such that 


M >, F(M) >g ... —>g F*(M) € NFg 
That is, if the term has an infinite reduction, then repeated application of F 


yields an infinite reduction sequence. 
Define Fæ : A —> A as follows. If M € NFg then Fo(M) = M; other- 


wise® 
F(x PQ R) = «PF,(Q)R If PE NFs,Q ¢NFg 
F(A. P) = AG FP) 
Fy((Av.P) QR) = P{r:=Q}R If £ € FV(P) or Q € NFg 


Fy((Av-P) QR) = (Az.P) F(Q) R Ifa €FV(P) and Q ¢ NFg 


? As usual, F°(M) = M and F**!(M) = F(F*(M)). 
3By P we denote a finite, possibly empty, sequence of terms. 
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Show that F is perpetual. 

Let A; be the set of all A-terms M such that any part Ax.P of M satisfies 
x € FV(P). For instance, I € Ay and Q € A; but K = Az.ày.x ¢ Ar. Show 
that for any M € Ay: M € WNg iff M € SNo. 

Hint: Compare being weakly normalizing with F; leading to a normal 
form, and compare begin strongly normalizing with F leading to a normal 
form. What is the relation between F} and F on M € A;? 

Since A; is a subset of A, the elements of A; that have a type in A> 
(a la Curry) must correspond to a subset of all proofs in IPC(—). Which 
proofs are these? 


CHAPTER 5 


Proofs as combinators 


In the preceding chapters we have considered various systems of A-calculi. 
One rather disturbing aspect of these systems is the role played by bound 
variables, especially in connection with substitution. In this chapter we 
consider a system, combinatory logic, which is equivalent to A-calculus in a 
certain sense, and in which there are no bound variables. 

The first section introduces a version of combinatory logic analogous to 
type-free A-calculus. The second section presents simply typed combinatory 
logic, analogous to simply typed A-calculus. 

Since simply typed A-calculus corresponds to the natural deduction for- 
mulation of intuitionistic propositional logic via the Curry-Howard isomor- 
phism, and combinatory logic is a variant of A-calculus, it is natural to ex- 
pect that simply typed combinatory logic also corresponds to some variant of 
intuitionistic propositional logic. This variant, traditionally called Hilbert- 
style as opposed to natural deduction style, is introduced in the third section, 
and the fourth section presents the Curry-Howard isomorphism between the 
Hilbert-style intuitionistic propositional logic and combinatory logic. 

The fifth section studies special cases of the Curry-Howard isomorphism 
by investigating how certain restrictions in the logic are reflected by restric- 
tions in the functional calculus. 


5.1. Combinatory logic 


Combinatory logic was invented by Schonfinkel and Curry in the 1920’s 
shortly before Church introduced the lambda-calculus. The idea was to 
build the foundations of logic on a formal system in which logical formulas 
could be handled in a variable-free manner. 

As mentioned in Chapter 1, the systems of combinatory logic and à- 
calculus that aimed at providing a foundations of mathematics and logic 
turned out to be inconsistent, due to the presence of arbitrary fixed-points— 
see [7, App. B] or [55, Chap. 17]. Nevertheless, one may distinguish a useful 
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subsystem of the original system of combinators dealing only with pure 
functions, and this system will be called combinatory logic below. 
The objects of study in combinatory logic are the combinatory terms. 


5.1.1. DEFINITION. The set C of combinatory terms is defined by the gram- 
mar: 


C:=V |K (S| (ce) 


where V is the same set of variables as used in A. The notational conventions 
concerning parentheses are the same as for lambda-terms. 


5.1.2. DEFINITION. The reduction relation >, on combinatory terms, called 
weak reduction is defined by the following rules: 


e KFG —,  F; 
© SFGH —,, FH(GH); 
e If F —,, F’ then FG —>„ F'G and GF —,, GF’. 


The symbol —,, denotes the smallest reflexive and transitive relation con- 
taining >w, and =, denotes the least equivalence relation containing >. 

A w-normal form is a combinatory term F such that F Aw G, for all 
combinatory terms G. 


5.1.3. EXAMPLE. 
e Let I = SKK. Then, for all F, we have IF >y KF (KF) >u F. 
e The term SII(SII) reduces to itself. 
e Let W = SS(KI). Then, for all F, GŒ, we have WFG —>u FGG. 
e Let B = S(KS)K. Then, for all F, G, H, we have BFGH —, F (GH). 
e Let C = S(BBS)(KK). Then CFGH —,, FHG, for all F,G, H. 


e K,S,KS,SK, and S KK are w-normal forms. 


The following gives the first hint that combinatory logic is essentially 
simpler than A-calculus in some respects. 


5.1.4. DEFINITION. For F € C define the set FV(F) of free variables of F 


by: 
FV(x) = {2}; 
FV(H G) = FV(A)UFV(G); 
FvV(S) = {} 
FV(K) = Uk 
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For F,G €C and x € V define substitution of G for x in F by: 


x{x := G} = G; 

y{x := G} = y ifs#y; 

(H EHz:=G} = Adiga G} he G}; 
S{x := G} =S; 

K{x:= G} = K. 


Note that there are no bound variables, and no need for renaming in 
substitutions. 
The following is similar to the the Church-Rosser property for A-calculus. 


5.1.5. THEOREM (Church-Rosser property). If F >w Fi and F >u F> 
then Fy >w G and Fy >w G, for some G. 


PROOF. See the exercises. oO 


One can then infer Corollaries similar to 1.35-37 in Chapter 1. 
There is an obvious similarity between terms of lambda-calculus and 
combinatory terms. A translation 


(Ja: Coa 


is easy to define. We just identify K and S with the corresponding lambda- 
terms: 


5.1.6. DEFINITION. 
e (x) =x, for x EV; 
e (K)a = àty.z; 
e (S)a = àzyz.zz(yz); 
e (FG)a = (F)a(G)a- 


5.1.7. PROPOSITION. If F —>w G then (F)a ge (G)a. 


PRrooF. By induction on the derivation of F >w G. O 


5.1.8. REMARK. It is not in general the case that (F)a —»g (G), implies 
F —, G. Counter-example: (S (K I) K), >g (K), but S (K I) K A, K 


It is less obvious how to make a translation backward, because we have 
to define lambda abstraction without bound variables. One of the possible 
methods is as follows. 


5.1.9. DEFINITION. For each F € C and each x € V we define the term 
Ma.F EC. 
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e Mar.xc =T; 
e à*x.F = KF, if x g FV(F); 
e à*x.FG = S(A*x.F)(A*x.G), otherwise. 


The following shows that the definition of abstraction behaves (partly) 
as expected. 


5.1.10. PROPOSITION. (A*x.F)G —>w F{x := G} 


PROOF. Exercise 5.6.3. O 


Using the operator A*x, we can define a translation 
(jer Axe 
as follows. 
5.1.11. DEFINITION. 
e (x)c =x, for re V; 
e (MN)c = (M)e(N)c; 
e (At. M)e = à*x.(M)c. 


5.1.12. REMARK. It is natural to expect, dually to Proposition 5.1.7, that 
one could use Proposition 5.1.10 to prove that 


M —>s N => (M)cw (Ne (*) 


However, this property does not hold. For instance Ax.I I —g Ax.I, but 
Az IIe = S (K I) (K I) Aw K I = Acre. 

If one attempts to prove (x) by induction on the derivation of M —>g N, 
one runs into difficulties in the case M —>ẹ N => As.M —>g Ax.N. The 
problem is that the corresponding principle 


F >u G > \*xr.F >u *2.G (£) 


fails. The references at the end of the chapter contain more information 
about this problem. 


The following shows that the translations between A and C are inverses in 
a weak sense. 


5.1.13. PROPOSITION. For all M € A, we have ((M)c)a =e M. 


PROOF. Exercise 5.6.4. O 
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Because of Propositions 5.1.7 and 5.1.13, we can think of ( ), as of a 
homomorphic embedding of the combinatory logic into the lambda-calculus. 
In what follows, we often abuse the notation by using the names S, K, etc. for 
the A-terms (K),, (S)a, etc. 

The following property is sometimes expressed by saying that K and S 
make a basis for untyped A-calculus. 


5.1.14. COROLLARY. Every closed lambda term M is beta-equal to a term 
obtained from K and S solely by application. 


PROOF. The desired term is ((M)c)aq. oO 


Unfortunately, the embedding ( )a : C — A is not an isomorphism. Put 
differently, the left inverse operator ( )¢ is only a projection (retraction). 
Indeed, we have already seen that the statement dual to Proposition 5.1.7 
fails, and the same holds for the statement dual to Proposition 5.1.13. 


5.1.15. EXAMPLE. ((K)a)e = S(KK)I Zu K. 


It follows that “weak” equality is actually a strong property! 


5.2. Typed combinators 
Since combinatory terms can be seen as a subset of lambda-terms, they can 


also inherit the structure of simply-typed lambda-calculus. Of course, there 
are two ways to do this. 


5.2.1. DEFINITION. Define the typability relation F on C x C x II by: 


DEET EST 


TKEK:o0o-TOo 


TtS:(¢-T->p)- (o> T)7- o> ~p 


T+} M:o7>7r TF N:o 
Tt MN:7 


for all types o,7 and p and arbitrary context T. 


The other formulation of simply typed combinatory logic uses combina- 
tory terms a la Church. 
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5.2.2. DEFINITION. Define the set Cy of combinatory terms à la Church by 
the grammar: 


Cu = V | Kor | Soro | (Cr Cn) 
Define the typability relation F on C x Cy x H by: 


PETF HE 


PRK geo >To 


T F Sorp: le >T > p) > (o > T) >00 —>p 


T+} M:o7>7r TrTEN:0 
TiEMN:+ 


Following the path of Chapter 3 we could derive the usual properties, 
e.g., the free variables lemma, a version of the generation lemma, and so 
on, for each of the two combinatory logics with types. In some cases, e.g. 
the proof of subject reduction, the proof is simpler since reduction does not 
entail any substitutions, in contrast to the case of 3-reduction. Moreover, we 
might also prove an equivalence result analogous to Propositions 3.3.2-3.3.3. 
However, for the sake of brevity, we shall not do so. 

To distinguish between the typing relation for simply typed combinatory 
logic and the one for simply typed A-calculus, we shall use Fg and F4 for the 
two, respectively. In the remainder of the notes it will be clear from context 
whether the typing relations refer to à la Curry or à la Church systems, both 
in connection with combinatory logic and A-calculus. 

It is not difficult to see that our embedding ( ), preserves types. In 
addition, the same is true for the translation ( )c, but this requires the 
following lemma: 


5.2.3. LEMMA. Let T,x2: pte F:7. Then I te Ma.F: pr. 


PROOF. By induction on F. oO 
5.2.4. PROPOSITION. 

1. YT e EF sehen T Fa (F)a:rT. 

2. fT, M:7 then T ke (Me: rT. 


PRooF. (i): By induction on the derivation of He F : 7. (ii): By induction 
on the derivation of IT Fa M : T, using Lemma 5.2.3 oO 


5.2.5. COROLLARY. The simply-typed version of the calculus of combinators 
has the strong normalization property. 


PRooF. By strong normalization of simply typed A-calculus and Proposi- 
tion 5.1.7. o 
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5.3. Hilbert-style proofs 


Recall from Chapter 2 and 4 that, so far, our formal proofs have been of the 
natural deduction style. Apart from the sequent calculus style of presenta- 
tion, which will be introduced later, there is yet another style of presentation 
of logics, known as the Hilbert-style. In fact, this is the traditional approach 
to the definition of a formal proof. A Hilbert-style proof system consists of 
a set of axioms and only a few proof rules. 

Below we describe such a system for the implicational fragment of propo- 
sitional intuitionistic logic. This system has only one proof rule, called modus 
ponens, which is sometimes translated to English as “detachment rule”: 


p, Pry 
Y 


There will be two axiom schemes. That is, all formulas that fit the patterns 
below are considered axioms: 


(Al) y => 4 > y; 
(A2) (y > 4 > 9) > (p> yy ù. 


Note that there are in fact infinitely many axioms. But this does not bother 
us as long as they can be effectively described. Formal proofs in Hilbert-style 
systems are traditionally defined as sequences of formulas. 


5.3.1. DEFINITION. A formal proof of a formula y from a set [ of assump- 
tions is a a finite sequence of formulas Y1, Y2,... , Yn, such that Yn = y, 
and for all i = 1,... n, one of the following cases takes place: 


e vy; is an axiom, or 
e y; is an element of I, or 


e there are j, l < i such that Y; = ve —> Yi (i.e., Yi is obtained from Yj, 
Wve using modus ponens). 


We write I’ Fy ¢ if such a proof exists. The notation Fy obeys the usual 
conventions. 


5.3.2. EXAMPLE. Here is a proof of y — y from the empty set. 


1. (po (b> 9) 9) > (Y> W> p) > (p> &)) (axiom A2); 


2. p> (Y> p)>p (axiom Al); 


3. (p => (Y > p)) > (p —> p) (modus ponens: detach 2 from 1); 


4. p> (Y — y) (axiom Al); 
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5. p> yp (modus ponens: detach 4 from 3); 


5.3.3. EXAMPLE. And here is a proof of V from {py > y, Y — ù, p}: 
1. y— yw (assumption); 
2. y (assumption); 
3. % (modus ponens: detach 2 from 1); 
4. Ņp— V (assumption); 
5. V (modus ponens: detach 3 from 4). 


The following important property of Hilbert-style proof systems is called 
the Deduction Theorem. 


5.3.4. PROPOSITION (Herbrand, 1930). T, Fy Y ifT Fy >y. 


ProoF. The proof from right to left requires one application of modus po- 
nens and weakening. For the other direction, proceed by induction on the 
size of the proof. o 


Note how easy the proof of y — y becomes with the availability of the 
deduction theorem, as compared to having to do the direct proof explicitly. 


5.3.5. PROPOSITION. For everyT andy: Ty ọ iff {Fg ¢. 


ProoFr. The right to left part is an easy induction. The converse is also 
easy, using the Deduction Theorem. oO 


We conclude that our Hilbert-style system is complete in the sense of 
both Heyting algebras and Kripke models. 


5.3.6. THEOREM. T H ọ iff T Fy g. 


PROOF. Immediate from the completeness for natural deduction and the 
previous proposition. O 


5.3.7. REMARK. By adding axioms to handle the other connectives, one can 
obtain complete Hilbert-style proof systems for full propositional intuition- 
istic logic and for classical propositional logic. It is perhaps interesting that 
a complete proof systems for classical propositional calculus is obtained by 
adding only the axiom schemes 


e | — ọ; 


e (p> Y)> p)> y. 
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(Recall that V and A can be defined in classical logic by — and L.) 


The following is a version of the Curry-Howard Isomorphism for Hilbert- 
style proof systems and combinatory logics. We work with combinatory 
terms à la Church. 


5.3.8. PROPOSITION. 


(i) YT te F: then |T| fx o. 
(ii) ST Fy gy then there exists F € C such that A te F : p, where 
A= {(tp: 9) | € TH. 


PROOF. (i): by induction on the derivation of T Fe M: y. 
(ii): by induction on the derivation of T Fy y. oO 


The Curry-Howard isomorphism in the case of Hilbert-style proofs and 
combinatory terms is realized by a correspondence between proofs and and 
Church-style combinatory terms. Here we have the following pairs of equiv- 
alent notions: 


application modus ponens 
variable assumption 
constants K and S axioms 


5.4. Relevance and linearity 


Neither intuitionistic nor classical logic have any objections against the ax- 
iom scheme y —> wW — y, which expresses the following rule of reasoning: 
“an unnecessary assumption can be forgotten”. This rule is however du- 
bious when we are interested in the relevance of assumptions with respect 
to the conclusion. Logicians and philosophers have studied various variants 
of intuitionistic logic in which restrictions are made concerning the manip- 
ulation of assumptions. The classical references here are [1] and [2], but 
the idea of relevant logics dates back to early 50’s. Hindley [54] attributes 
the idea to Moh and Church. Just like no use of an assumptions may be 
regarded as a dubious phenomenon, multiple use of an assumption may also 
raise important doubts. The most ancient reference to a logic in which this 
was taken into account, given by Hindley [54], is a work of Fitch from 1936. 

With the Curry-Howard isomorphism at hand, we can easily identify 
the corresponding fragments of (the implicational fragment of) intuitionis- 
tic propositional logic, by characterizing lambda-terms with respect to the 
number of occurrences of bound variables within their scopes. 
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5.4.1. DEFINITION. 


1. The set of AI-terms is defined by the following induction: 


e Every variable is a \I-term; 
e An application MN is a Al-term iff both M and N are AI-terms; 
e An abstraction \x.M is a AI-term iff M isa \I-term and x € FV(M). 


2. The set of BCK-terms is defined as follows: 


e Every variable is a BCK-term; 


e An application MN is a BCK-term iff both M and N are BCK- 
terms, and FV(M) NFV(N) = {}; 
e An abstraction Axz.M is a BCK-term iff M is a BCK-term. 


3. A term is called linear iff it is both a AI-term and a BCK-term. 


Of course, AI-terms correspond to reasoning where each assumption is used 
at least once, but all assumptions are reusable. The BCK-terms represent 
the idea of disposable assumptions that are thrown away after a use, so they 
cannot be reused. A strict control over all assumptions, with each one being 
used exactly once, is maintained in proofs corresponding to linear terms. 
The three classes of lambda-terms determine three fragments of IPC(—): 


Relevant logic AI-terms 
BCK-logic BCK-terms 
BCL logic linear terms 


The above table can be taken as a formal definition of these three logics, 
in that the A-calculi simply are the logics. Below we give more traditional 
Hilbert-style formulations of the logics. 


5.4.2. DEFINITION. 


1. The relevant propositional calculus is a Hilbert-style proof system with 
the modus ponens as the only rule, and the following axiom schemes: 


As) (p> b> ù) > (p > 4)> y> ð; 
Ag) Y > ù) > (p >Y) > p> ù; 
Ac) (ep - o> 8) > p> p-> ù; 

Ar) p>} 
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2. The BCK propositional calculus is a Hilbert-style proof system with 
the modus ponens as the only rule, and the axiom schemes (Ag) and 
(Ac) and 


Ak) p> yy. 


3. The BCI propositional calculus is a Hilbert-style proof system with 
the modus ponens as the only rule, and the axiom schemes (Ag) and 
(Ac) and (Az). 


5.4.3. WARNING. The expression “linear logic” denotes a system which is a 
strict extension of the BCI-logic. (But linear logic is based on the same 
principle as BCT-logic: every assumption is used exactly once.) 


Of course the axioms (Ax) and (Ag) are exactly our axioms (A1) and (A2) 
of the full IPC(—). The other axioms can also be seen as types of combina- 
tors (see Example 5.1.3). We have: 


e B = Aryz.z(yz): (Y > V) > (y > Y) > y > ù; 
e C = \àzyz.zzy : (p > Y => V) > Y> y> v. 


Clearly, our three logics correspond to fragments of C generated by the 
appropriate choices of combinators. This explains the abbreviations AI, 
BCK and BCI. The full untyped lambda-calculus is sometimes called AK- 
calculus. 

We have still to justify that the above definitions are equivalent to those 
obtained by appropriately restricting occurrences of variables in lambda- 
terms. First we have the obvious part (remember that we identify combina- 
tory terms with their translations via ( ),). 


5.4.4. LEMMA. 


1. The combinators S, B, C, I are Al-terms, and so are all terms obtained 
from S, B, C, I by applications; 


2. The combinators B, C, K are BCK-terms, and so are all terms ob- 
tained from B, C, K by applications; 


3. The combinators B, C, I are BCI-terms, and so are all terms obtained 
from B, C, I by applications. 


Thus, the embedding ( ), translates the appropriate fragments of C into 
the appropriate fragments of A. But the inverse translation ( )¢ cannot be 
used anymore, as it requires S, and K to be available. We need first to 
redefine the combinatory abstraction A*. 


86 Chapter 5. Proofs as combinators 


5.4.5. DEFINITION. 

1. For each term in C and each x € V we define the term \°x.M EC. 
e Xxx =T, 
e \°x.F = KF, whenever x ¢ FV(F); 
e \Ma.FG = S(\°u.F)(X°x.G), if x € FV(F) N FV(G); 
e \°x.FG = C(X°x.F)G, if x € FV(F) and x ¢ FV(G); 
e X° x.FG = BF(X2.G), if x g FV(F) and x € FV(G). 

2. Now define a translation | ]e : A — C, as follows: 
e [z]c =x, for x EV; 
e [MN]e = [M]e[N]c; 
e [Ar.M]c = °2.[M]c. 

The translation [| ]¢ : A — C has all the good properties of ( )c¢. That is, 


Propositions 5.1.10, 5.1.13 and 5.2.4 remain true. (For the proof note first 
that (A°x.F)a =g (A*a.F),.) In addition we have: 


5.4.6. PROPOSITION. 


1. If M is a Al-term, then |M]c is built solely from the combinators S, 


B, C and I. 

2. If M is a BCK-term then [M]c is built solely from the combinators 
B, C and K. 

3. If M is a linear term then |M]c is built solely from the combinators 
B, C and I. 

Proor. Easy. Uses the following property: FV([M]c) = FV(M). oO 


It follows that the translation | ]¢ can be seen as an embedding of each 
of the appropriate fragments of C into the corresponding fragment of simply 
typed lambda calculus. We can conclude with the following summary: 


5.4.7. THEOREM. 


e A formula vy is a theorem of relevant logic if and only if it is a type of 
a Al-term; 


e A formula y is a theorem of BCK-logic if and only if it is a type of a 
BCK-term. 


e A formula ọ is a theorem of BCI-logic if and only if it is a type of a 
linear term. 


PROOF. Immediate from Proposition 5.4.6, and the appropriate modifica- 
tions of Propositions 5.1.13 and 5.2.4. oO 
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5.5. Historical remarks 


Combinatory logic was introduced by Curry in some early papers [21, 22, 23] 
and is also studied at length in some newer books [24, 25], which are still 
very readable. 

Hilbert-style proofs are often used in text books on logic that are not 
concerned with proof normalization in particular, or proof theory in gen- 
eral. It is interesting to note that the deduction theorem, which provides 
a translation from natural deduction proofs to Hilbert-style proofs, and the 
abstraction operator, which provides a translation from typed combinatory 
terms to typed A-terms, were discovered independently in work on Hilbert 
systems and work on combinatory logic, although they are essentially the 
same result. This is just one example of a number of results that have been 
discovered independently in work on logical systems and functional calculi. 

Incidentally, the correspondence between (-equality and weak equality 
is not as tight as one might hope for. However, if one adds a certain— 
somewhat involved—set of rules, called Ag, to the rules for weak equality, 
the resulting relation is equivalent to G-equality in the sense that the above 
translations between A and C preserve equality and are each other’s inverses. 
In particular, the extended equality on combinators is closed under rule (£). 

The correspondence between (-equality and weak equality is more ele- 
gant in the extensional versions of these calculi. More precisely, if one adds 
the principle of extensionality 


Pz=6 Pak xgFV(P P) > P = P' (ext) g 


to =, and the similar principle (ext), to weak equality, then the resulting 
calculi are equivalent in the above sense. 

Adding rule (ext) to =g is equivalent to adding so-called n-equality (see 
Chapter 6), and adding rule (ext) to =w is equivalent to adding a certain 
set of equational axioms, called Agy. More about all this can be found, e.g., 
in [7]. 


5.6. Exercises 


5.6.1. EXERCISE. Find a combinator 2 € C such that 2F'A —, F (FA), for 
all F and AinC. 


5.6.2. EXERCISE. Prove the Church-Rosser property for weak reduction us- 
ing the Tait & Martin-Lof method from Chapter 1. Note that the proof for 
combinatory logic is somewhat simpler due to the fact that non-overlapping 
redexes remain non-overlapping during reduction of other redexes. 


5.6.3. EXERCISE. Prove Proposition 5.1.10. 
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5.6.4. EXERCISE. Prove Proposition 5.1.13. 


5.6.5. EXERCISE. Give a Hilbert-style proof of the formula 
(yr) + W> I) > yd. 


5.6.6. EXERCISE. Give a detailed proof of the Deduction Theorem. Use your 
proof to give an abstraction operator, like X*. 


5.6.7. EXERCISE. Describe a notion of reduction for Hilbert-style proofs, 
corresponding to weak reduction on combinatory terms. 


5.6.8. EXERCISE. Consider the following variant of the calculus of combina- 
tors: there are typed constants K,,, and S,,,,, with typing and reduction 
rules as usual, and in addition, there are additional constants I, : T — T 
with the reduction rule IL-F — F. (The identity combinator cannot now be 
defined as SKK because not all typed forms of S are available.) By em- 
bedding into Church-style combinatory logic, show that this variant satisfies 
subject reduction and strong normalization properties. 


5.6.9. EXERCISE. (Based on [16]) Consider the terms : K = Azy.xz, S° = 
Aixyz.ilil(x(iz))(ily(iz))))) and I = Ax.x. Show that these terms form a 
basis for lambda-calculus in the sense of Corollary 5.1.14, but their types 
(whatever choice is taken) do not make a complete Hilbert-style axiom sys- 
tem for IPC(-). 

Hint: One cannot derive the formula (p > p > q) > p > q. 


5.6.10. EXERCISE. Adopt your solutions of Exercises 5.6.1 and 5.6.3 to the 
case of the translation [| ]e of Section 5.4. 


CHAPTER 6 


Type-checking and related problems 


In this chapter we discuss some decision problems related to simply-typed 
lambda calculus and intuitionistic propositional logic. We are mostly inter- 
ested in decision problems arising from the analysis of the ternary predicate 
‘T F M : 7” in the Curry-style version of simply-typed lambda calculus. 
But the following definition makes sense for every type-assignment system 
deriving judgements of this form (including Church-style systems). 


6.0.11. DEFINITION. 


1. The type checking problem is to decide whether + M : 7 holds, for 
a given context I’, a term M and a type T. 


2. The type reconstruction problem, also called typability problem, is to 
decide, for a given term M, whether there exist a context [ and a 
type 7, such that [+ M : rT holds, i.e., whether M is typable. 


3. The type inhabitation problem, also called type emptiness problem, is 
to decide, for a given type 7, whether there exists a closed term M, 
such that F M : r holds. (Then we say that T is non-empty and has 
an inhabitant M). 


An obvious motivation to consider type-checking and type reconstruction 
problems comes of course from programming language design, especially 
related to the language ML, see [72, 27]. But there were earlier results 
concerning this problem, due to Curry, Morris and Hindley. See [54, pp. 
33-34], for historical notes. 

If we look at the type reconstruction problem from the point of view 
of the Curry-Howard isomorphism, it becomes a problem of determining 
whether a given “proof skeleton” can be actually turned into a correct proof 
by inserting the missing formulas. It may be surprising that this kind of 
questions are sometimes motivated by proof-theoretic research. As noted 
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in [54, pp. 103-104], the main ideas of a type-reconstruction algorithm can 
be traced as far as the 20’s.! See [114], for a fresh work, where the “skeleton 
instantiation” problem is discussed, without any relation to types. 

For the type inhabitation problem, the Curry-Howard isomorphism gives 
an immediate translation into the language of logic: 


6.0.12. PROPOSITION. The type inhabitation problem for the simply-typed 
lambda calculus is recursively equivalent to the validity problem in the im- 
plicational fragment of intuitionistic propositional logic. 


PROOF. Obvious. oO 


The above proposition remains true for other typed languages, for which the 
Curry-Howard isomorphism makes sense. 

From a programmer’s point of view, the type inhabitation problem can 
be seen as follows: An empty type (a type which cannot be assigned to any 
term) means a specification that cannot be fulfilled by any program phrase. 
Solving type inhabitation means (in the contexts of modular programming) 
the ability to rule out such specifications at compile time. 


6.1. Hard and complete 


This short section is to recall a few basic notions from complexity theory. 
The reader is referred to standard textbooks, like [57], for a more compre- 
hensive discussion. 


6.1.1. DEFINITION. The notation LOGSPACE, PSPACE and P, refers re- 
spectively to the classes of languages (decision problems) solvable by de- 
terministic Turing Machines in logarithmic space, polynomial space, and 
polynomial time (measured w.r.t. the input size). 


6.1.2. DEFINITION. We say that a language Lı is reducible to a language Lo 
in logarithmic space (or LOGSPACE-reducible) iff there is a Turing Machine, 
that works in logarithmic space (we count only the work tapes, not the input 
or output tapes) and computes a total function f, such that 


wel, iff f(w) E Lo, 


for all inputs w. Two languages are LOGSPACE-equivalent iff there are 
LOGSPACE-reductions each way. 


That is, to decide if w € Lı one can ask if f(w) € Le, and the cost of the 
translation is only shipping and handling. Note that a logarithmic space 
reduction takes at most polynomial time, so this notion is slightly more 
general than that of a polynomial time reduction. 


1The good old Polish school again ... 
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6.1.3. DEFINITION. We say that a language L is hard for a complexity class 
C, iff every language L’ € C is reducible to L in logarithmic space. If we 
have L € C in addition, then we say that L is complete in the class C, or 
simply C-complete. 


6.2. The 12 variants 


The type reconstruction problem is often abbreviated by “?  M:?”, and 
the type inhabitation problem is written as “+ M : ?”. This notation nat- 
urally suggests other related problems, as one can choose to replace various 
parts of our ternary predicate by question marks, and choose the context 
to be empty or not. A little combinatorics shows that we have actually 12 
problems. Out of these 12 problems, four are completely trivial, since the 
answer is always “yes”: 


e 2? 2:2; 

eT ?:?2; 

e F222; 

e ?F?:T. 
Thus we end up with eight non-trivial problems, as follows: 
[Tt M:7 (type checking); 
+ M:r (type checking for closed terms); 


?t M:7 (type checking without context); 


?t M:? (type reconstruction); 

+ M:? (type reconstruction for closed terms); 
[Tt M:? (type reconstruction in a context); 

+ ?:7  (inhabitation); 

['- ?:7  (inhabitation in a context). 


Most of these problems can easily be shown LOGSPACE-equivalent to one 
of our three main problems: (1), (4) or (7). Some of these LOGSPACE 
reductions are just inclusions. Indeed, problem (2) is a special case of (1) 
and of (3), problem (5) is a special case of (4) and (6), and problem (7) is 
a special case of (8). Others are the subject of Exercises 6.8.1 and 6.8.3. 
An exception is problem (3). Problems (1), (2) and (4)—(6) reduce to (3) in 
logarithmic space, but we do not know of any simple LOGSPACE reduction 


92 Chapter 6. Type-checking and related problems 


the other way.? However, such reductions exists between all problems (1)- 
(6), because all they turn out to be P-complete. 

Let us make one more remark here: On a first look it might seem that 
determining whether a given term has a given type in a given environment 
could be easier than determining whether it has any type at all. This impres- 
sion however is generally wrong, as type reconstruction is easily reducible to 
type checking, see Exercise 6.8.1. This reduction is “generic”, i.e., it works 
for all reasonable typed calculi. 

It is quite unlikely to have a reduction from (7) or (8) to any of (1)—(6), 
because the inhabitation problems are PSPACE-complete, and that would 
imply P = PSPACE. We do not know about a simple reduction the other 
way. 


6.3. (First-order) unification 


The following is a general definition of (first-order) unification. In what 
follows we will need only a special case, where the first-order signature is 
fixed to consist of only one symbol: the binary function symbol “=>”. 


6.3.1. DEFINITION. 


1. A first-order signature is a finite family of function, relation and con- 
stant symbols. Each function and relation symbol comes with a des- 
ignated non-zero arity. (Constants are sometimes treated as zero-ary 
functions.) In this section we consider only algebraic signatures, i.e., 
signatures without relation symbols. 


2. An algebraic term over a signature X, or just term is either a variable 
or a constant in ©, or an expression of the form (ft; ... tn), where f is 
an n-ary function symbol, and t1,... ,t, are algebraic terms over X.’ 
We usually omit outermost parentheses. 


The formal definition of an algebraic term involves a prefix application of 
function symbols. Of course, there is a tradition to write some binary func- 
tion symbols in the infix style, and we normally do it this way. Our most 
beloved signature is one that has the (infix) arrow as the only symbol. It is 
not difficult to see that algebraic terms over this signature can be identified 
with simple types, or with implicational formulas if you prefer. 

In general, algebraic terms over X can be identified with finite labelled 
trees satisfying the following conditions: 


e Leaves are labelled by variables and constant symbols; 


?A solution was given by Henning Makholm, see Chapter 14, Exercise 6.8.3. 
3Do not confuse algebraic terms with lambda-terms. 
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e Internal nodes with n daughters are labelled by n-ary function sym- 
bols. 


6.3.2. DEFINITION. 


1. An equation is a pair of terms, written “t = u”. A system of equations 
is a finite set of equations. Variables occurring in a system of equations 
are called unknowns. 


2. A substitution is a function from variables to terms which is the iden- 
tity almost everywhere. Such a function S is extended to a function 
from terms to terms by S(ft1...tn) = fS(t1)---S (tn) and S(c) = c.t 


3. A substitution S is a solution of an equation “t = u” iff S(t) = S(u) 
(meaning that S(t) and S(w) is the same term). It is a solution of a 
system E of equations iff it is a solution of all equations in EF. 


Thus, for instance, the equation f(gry)x = fz(fyy) has a solution S with 
S(x) = fyy, Sly) = y and S(z) = g(fyy)y (and many other solutions 
too), while the equation f(gry)c = fz(fyy), where c is a constant, has no 
solution. This is because no substitution can turn fyy into c. Another 
example with no solution is f(gxy)x = fx(fyy), but this time the reason is 
different: if S were a solution then S(x) would be a proper subterm of itself. 

The problem of determining whether a given system of equations has a 
solution is called the unification problem. It is not difficult to see that there 
is no loss of generality in considering single equations rather than systems of 
equations (Exercise 6.8.5). The unification algorithm (we say “the”, because 
all these algorithms are actually based on similar ideas, and differ only in 
details) is due to J.A. Robinson [93], and was motivated by the first-order 
resolution rule. But, as pointed out by Hindley [54, pp. 43-44], there were 
also earlier works. Discussions of unification algorithms can be found in 
various textbooks, for instance in [74]. 

We choose to sketch a version of the algorithm that is “algebraic” in 
style. For this, we need the folllowing definition. 


6.3.3. DEFINITION. 


1. A system of equations is in a solved form iff it has the following prop- 
erties: 
e All equations are of the form “x = t”, where x is a variable; 


e A variable that occurs at a left-hand side of an equation does not 
occur at the right-hand side of any equation; 


e A variable may occur in only one left-hand side. 


“Thus, a substitution is a valuation in the algebra of all terms over X. 
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A variable not occurring as a left-hand side of any equation is called 
undefined. 


2. A system of equations is inconsistent iff it contains an equation of 
either of the forms: 


è “gui... Up = ft,...tq”, where f and g are two different function 
symbols; 


e “c= ft,...t,”, or “ft, ...tg =”, where cis a constant symbol 
and f is an n-ary function symbol; 


e “c= d’, where c and d are two different constant symbols; 


e “x = ft,...tg”, where x is a variable, f is an n-ary function 
symbol, and x occurs in one of t1,... , tg. 


3. Two systems of equations are equivalent iff they have the same solu- 
tions. 


It is easy to see that an inconsistent system has no solutions and that a 
solved system E has a solution So defined as follows: 


e If a variable x is undefined then So(x) = z; 
e If “x =?” is in E, then So(x) = t. 
The core of Robinson’s algorithm can be seen as follows: 


6.3.4. LEMMA. For every system E of equations, there is an equivalent sys- 
tem E’ which is either inconsistent or in a solved form. In addition, the 
system E’ can be obtained by performing a finite number of the following 
operations: 


a) Replace “x = t” and “r = s” (where t is not a variable) by “x = t” 
and “t= 8”; 


b) Replace “t= x” by “oe =t7} 

c) Replace Fly eg = fui... Un” by “ti = u1”, ... , n = Un”; 

d) Replace “x = t” and “r = s” by “xr = t” and “ela := t| = s|x := t|”; 
e) Remove an equation of the form “= t”. 


PROOF. As long as our system is not solved, and not inconsistent, we can 
always apply one of the operations (a)-(d). We leave it as Exercise 6.8.8 
to show that this process terminates (unless (b) or (d) is used in a silly 
way). O 
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6.3.5. COROLLARY. The unification problem is decidable. oO 


In fact, the above algorithm can be optimized to work in polynomial time 
(Exercise 6.8.10), provided we only need to check whether a solution exists, 
and we do not need to write it down explicitly, cf. Exercise 6.8.6. The 
following result is from Dwork et al [33]. 


6.3.6. THEOREM. The unification problem is P-complete with respect to Log- 
space reductions. oO 


Suppose that we have a system of equations Æ, which is transformed to an 
equivalent solved system E’. The solution Sọ of E’ defined as above, is a 
most general solution of E’ and E, because every other solution must be a 
specialization of So. Formally we have the following definition. 


6.3.7. DEFINITION. 


e If P and R are substitutions then P o R is a substitution defined by 
(Po R)(x) = P(R(x)). 


e We say that a substitution S' is an instance of another substitution R 
(written R < S) iff S = Po R, for some substitution P. 


e A solution R of a system F is principal iff the following equivalence 
holds for all substitutions S: 


S is a solution f E if R< S. 


6.3.8. PROPOSITION. If a system of equations has a solution then it has a 
principal one. 


PROOF. For a given system of equations F, let E’ be an equivalent system 
in a solved form, and let Sọ be as described above. Then Sọ is a principal 
solution of E. oO 


6.4. Type reconstruction algorithm 


We now show how type-reconstruction can be reduced to unification. This 
is a LOGSPACE-reduction, and it can easily be modified to work for all the 
problems (1)-(6) of Section 6.2. Since there is also a LOGSPACE-reduction 
the other way, the main result of this section may be stated as: 


6.4.1. THEOREM. Type-reconstruction in simply-typed lambda calculus is P- 
complete. 
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The first work where this result was explicitly stated was probably the M.Sc. 
Thesis of Jurek Tyszkiewicz [110]. Our proof of the theorem consists of two 
reductions. The first one is from type-reconstruction to unification. 

Let M be a lambda-term. Choose a representative of M so that no 
bound variable occurs free in M and no bound variable is bound twice. In 
what follows we work with this representative rather than with M as an 
equivalence class. By induction on the construction of M, we define: 


e a system of equations Em (over the signature consisting only of the 
binary function symbol —); 


e a type Ty. 


Of course, the idea is as follows: Ey will have a solution iff M is typable, 
and Tm is (informally) a pattern of a type for M. 


6.4.2. DEFINITION. 


e If M isa variable x, then Em = {} and TM = az, where ay is a fresh 
type variable. 


e If M is an application PQ then ty; = a, where a is a fresh type 
variable, and Em = Ep U Eg U {Tp = Tg > Qa}. 


e If M is an abstraction Ax.P, then Em = Ep and TM = Qz > Tp. 


It is not difficult to see that the above construction can be done in logarith- 
mic space. The main property of our translation is as follows. 


6.4.3. LEMMA. 


1. If TĀ M: p, then there exists a solution S of Em, such that p = 
S(Tm) and S(az) =T(x), for all variables x € FV(M). 


2. Let S be a solution of Em, and let T be such that T(x) = S(az), for 
alla € FV(M). Then TF M: S(ty). 


PROOF. Induction with respect to M. O 


It follows that M is typable iff Em has a solution. But Em has then a 
principal solution, and this has the folllowing consequence. (Here, S(T) is a 
context such that S(T) (x) = S(T(2)).) 


6.4.4. DEFINITION. A pair (I',7), consisting of a context (such that the do- 
main of T is FV(M)) and a type, is called the principal pair for a term M 
iff the following holds: 
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e Tt M:7; 
e IfI’+ M:7' then I’ D S(T) and r’ = S(T), for some substitution S. 


(Note that the first condition implies S(T) | M : S(T), for all S.) If M is 
closed (in which case T is empty), we say that 7 is the principal type of M. 


6.4.5. COROLLARY. If a term M is typable, then there exists a principal pair 
for M. This principal pair is unique up to renaming of type variables. 


PROOF. Immediate from Proposition 6.3.8. oO 


6.4.6. EXAMPLE. 


e The principal type of S is (a —> 8 > y) — (a > B) —> a —> y. The 
type (a —> 8 > a) > (a > B) = a> a can also be assigned to S, 
but it is not principal. 


e The principal type of all the Church numerals is (a > a) > a > a. 
But the type ((a > 8) > a > p) > (a > p) = a = b can also be 
assigned to each numeral. 


To complete the proof of Theorem 6.4.1, we should also give the other re- 
duction. We only give a brief hint of how this should be done. First we 
reduce the general case of unification to our special arrow-only case (Exer- 
cise 6.8.7) and one equation only (Exercise 6.8.5). Then, for a given equation 
“t = o” , we consider the term Axry.x(yt,)(yt,), where x,y are new variables 
and terms t, and t, are as in Exercise 6.8.2. 


6.5. Eta-reductions 


We cannot hide this from the reader any more—we finally have to con- 
fess that other notions of reduction than beta-reduction are considered in 
lambda-calculi. In particular, we have eta-reduction, based on the following 
principle: 

At.Mx—, M, whenever x ¢ FV(M). 


Formally, we have the following definition: 

6.5.1. DEFINITION. We define the relation —>ņ as the least relation satisfying 
o If x g FV(M) then Ax.Max —, M; 
e If P—, P' then Az.P >, Ax.P'; 
e If P —„ P’ then PQ —, P'Q and QP > QP’. 


The notation —>ņ and =, has the expected meaning. We also use the symbols 
— 8n: Bn, =Gn to refer to reductions combining 8- and 1-reductions. 
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The motivation for this notion of reduction (and equality) is as follows: Two 
functions should be considered equal if and only if they return equal results 
for equal arguments. Indeed, we have 


6.5.2. PROPOSITION. Let =¢,; be the least equivalence relation such that: 
e If M = N then M =en N; 
e If M£ =ex, Nz, and x g FV(M)UFV(M) then M =x N; 
e If P = P! then PQ =ex P'Q and QP =ex QP’. 

Then =egt is identical to =g,. 


PROOF. Exercise 6.8.15. Note that the above definition does not contain 
the condition “If P =e, P’ then \x.P =e, Ax.P’”. This is not a mistake, 
because this property (called “rule £”) follows from the others. Oo 


We do not take —,, as our standard notion of reduction, because we do 
not want our calculus of functions to be extensional. After all, we want to 
be able to distinguish between two algorithms, even if their input-output 
behaviour is the same. 

The notions of eta- and beta-eta-reduction and equality have most of the 
good properties of beta-reduction and equality. In particular, the Church- 
Rosser theorem remains true, leftmost reductions are normalizing,” and on 
the typed level we still have both subject reduction and strong normalization 
properties. (Note that strong normalization for eta alone is immediate, 
as each eta-reduction step reduces the length of a term.) Of course, eta- 
reduction makes sense also for the Church-style typed terms. 


6.5.3. DEFINITION. We now define the notion of a Church-style term in an 
n-long normal form (or just long normal form). Recall that we write M7 
as an informal way of saying that the Church-style term M has type o in 
some fixed context. The definition is by induction: 


e If x is a variable of type 7) — --- > n > a, and Mj]’,... , My are 


in 7-long normal form, then (£M; ...Mn)® is in 7-long normal form. 


e If M” is in 7-long normal form then (Ax : 7.M)"~? is in n-long normal 
form. 


Thus a term in a long normal form is a term in normal form where all 
function variables are “fully applied” to arguments. 


6.5.4. LEMMA. For every Church-style term M° in beta normal form there 
exists a term MI in n-long normal form, such that MẸ —, M. 


PROOF. Easy. o 


5But the proof is somewhat more involved than for beta-reduction. 
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6.6. Type inhabitation 


In this section we prove a result of Statman [103], that the inhabitation 
problem for the finitely-typed lambda calculus is PSPACE-complete. In 
particular it is decidable. An immediate consequence is that provability 
in IPC(—) is also decidable and PSPACE-complete. The decidability was 
already known to to Gentzen in 1935, and we will discuss his (syntactic) 
proof in the next chapter. There are also semantic methods based on the 
existence of finite models. 

First observe that a type is inhabited if and only if there exists a closed 
Church-style term of that type. Thus it suffices to consider Church-style 
terms. First we prove that our problem is in PSPACE. 


6.6.1. LEMMA. There is an alternating polynomial time algorithm (and thus 
also a deterministic polynomial space algorithm) to determine whether a 
given type T is inhabited in a given context T. 


PROOF. If a type is inhabited then, by Lemma 6.5.4, it is inhabited by a 
term in a long normal form. To determine whether there exists a term M 
in a long normal form, satisfying [ F M : T, we proceed as follows: 


e If T= T7] — 7, then M must be an abstraction, M = Ax:7,.M’. Thus, 
we look for an M’ satisfying T, x: F M’: T2. 


e If 7 is a type variable, then M is an application of a variable to a 
sequence of terms. We nondeterministically choose a variable z, de- 
clared in I to be of type 7) —> --- > Tm — T. (If there is no such 
variable, we reject.) If n = 0 then we accept. If n > 0, we answer in 
parallel the questions if 7; are inhabited in T. 


This alternating (or recursive) procedure is repeated as long as there are 
new questions of the form I F? : 7. Note that if there are two variables 
in I, say x and y, declared to be of the same type ø, then each term M 
can be replaced with M[x/y] with no change of type. This means that a 
type T is inhabited in I iff it is inhabited in I — {y : co}, and it suffices to 
consider contexts with all declared types being different. At each step of 
our procedure, the context I either stays the same or it expands. Thus the 
number of steps (depth of recursion) does not exceed the squared number of 
subformulas of types in T,7, where IT  ?: 7 is the initially posed question. 
O 


To show PSPACE-hardness, we define a reduction from the satisfiability 
problem for classical second-order propositional formulas (QBF). We refer 
the reader to [57] for details about this problem. (But do not use the Polish 
translation.) 
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Assume that a second-order propositional formula ® is given. Without 
loss of generality we may assume that the negation symbol — does not occur 
in ®, except in the context ~p, where p is a propositional variable. 

Assume that all bound variables of ® are different and that no variable 
occurs both free and bound. For each propositional variable p, occurring 
in ® (free or bound), let ap and a4» be fresh type variables. Also, for each 
subformula y of ®, let a, be a fresh type variable. We construct a basis T'e 
from the following types: 


e (ap > ay) > (Ap > ay) — ag, for each subformula p of the 
form Ypy; 


© (ap > Ay) > Ay and (a-p > Ay) > Ay, for each subformula y of the 
form dpy; 


© ay — ay — ag, for each subformula y of the form w A %; 


© ay — ay and ay — ag, for each subformula y of the form y V ®. 


If v is a zero-one valuation of propositional variables, then T% is I’ extended 
with the type variables 


e ap, when v(p) = 1; 


e a py, when v(p) = 0. 


The following lemma is proven by a routine induction w.r.t. the length of 
formulas. Details are left to the reader. 


6.6.2. LEMMA. For every subformula y of ®, and every valuation v, defined 
on the free variables of p, the type ag is inhabited in T, iff v(y) = 1. 


PROOF. Exercise 6.8.18. O 


From Lemma 6.6.2 we obtain PSPACE-hardness, since the reduction can be 
performed in logarithmic space. This, together with Lemma 6.6.1 implies 
the main result of this section. 


6.6.3. THEOREM. The inhabitation problem for simply-typed lambda-calculus 
is complete for polynomial space. oO 
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6.7. Equality of typed terms 


As we have already observed, to verify whether two typable lambda-terms 
are beta-equal or not, it suffices to reduce them to normal form. One thing 
that often is overlooked here is that the complexity of this decision procedure 
depends on the size of particular type derivations (or Church-style terms) 
and not directly on the size of the pure lambda-terms to be verified. In the 
case of simply-typed lambda calculus, the cost of type-reconstruction is is a 
minor fraction of the total cost, even if we insist on the possibly exponential 
types to be written down. Indeed, we have the following theorem of Statman: 


6.7.1. THEOREM (R. Statman). The problem to decide whether two given 
Church-style terms M and N of a given type T are beta-equal is of non- 
elementary complexity. That is, for each r, the decision procedure takes 
more than exp,(n) steps on inputs of size n. (Recall that expp(n) = n and 
expj41(n) = 2°*Pe() ) 


The simplest known proof of this result is by H. Mairson [68]. This proof, 
like the original proof of Statman, uses validity for a simple higher-order 
logic as an intermediate step. It might be interesting to have a direct coding 
of Turing Machines into lambda-terms. 


6.8. Exercises 

6.8.1. EXERCISE. Show that: 
a) problem (4) reduces to problem (5); 
b) problem (5) reduces to problem (1); 
c) problem (1) reduces to problem (2); 
d) problem (8) reduces to problem (7) 


in logarithmic space. 


6.8.2. EXERCISE. Assume a context I consisting of type assumptions of the 
form (za : a). Define terms t- such that IT F t- : ø holds if and only if 
T=: 


6.8.3. EXERCISE. Show that problem (6) reduces to problem (4) in logarith- 
mic space. Hint: first do Exercise 6.8.2. 


6.8.4. EXERCISE. What’s wrong with the following reduction of problem (3) 
to problem (4)? To answer ?/ M:7 ask ? F Ayz.y(zM)(2t-) : ?. 
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6.8.5. EXERCISE. Show that for every system of equations there is an equiv- 
alent single equation. 


6.8.6. EXERCISE. Show that the size of a shortest possible solution of a 
given system of equations may be exponential in the size of that system. 
(Construct systems of equations of size O(n), such that all their solutions 
are of size at least exponential in n.) Can a solution be always represented 
in polynomial space? 


6.8.7. EXERCISE. Prove that the general form of the unification problem 
reduces in logarithmic space to unification over the signature consisting only 
of an arrow. 


6.8.8. EXERCISE. Complete the proof of Lemma 6.3.4. 


6.8.9. EXERCISE. Show examples of loops in the unification algorithm that 
may be caused by using rule (d) in a silly way, or removing the restriction 
in rule (a) that ¢ is not a variable. 


6.8.10. EXERCISE. Design a polynomial time algorithm to decide whether a 
given equation has a solution. 


6.8.11. EXERCISE. Modify the algorithm of Section 6.4 to obtain an algo- 
rithm for problem (3). 


6.8.12. EXERCISE. Prove the following converse principal type theorem: If 
y is a non-empty type, then there exists a closed term M such that y is the 
principal type of M. Hint: Use the technique of Exercise 6.8.2. (In fact, if 
N is a closed term of type 7, then we can require M to be beta-reducible 
to N.) 


6.8.13. EXERCISE. Show that every principal pair of a BCK-term in normal 
form has the following properties: 


e Each type variable occurs at most twice; 


e Ifit does, then one occurrence is positive (to the left of an even number 
of arrows) and the other negative. 


Also show that if ([,7) is a principal pair of a BCK-term M in normal form 
then M is an erasure of a Church style term in long normal form that has 
the type 7 in T. 


6.8.14. EXERCISE. (S. Hirokawa [56]) 
Prove that for a given pair (T,7), there is at most one BCK-term M in 
normal form such that ([',7) is its principal pair. 
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6.8.15. EXERCISE. Prove Proposition 6.5.2. 
6.8.16. EXERCISE. What is the natural deduction counterpart of eta-reduction? 


6.8.17. EXERCISE. Show examples of types that have exactly n normal in- 
habitants, for any number n € NU {No}. 


6.8.18. EXERCISE. Prove Lemma 6.6.2 


6.8.19. EXERCISE. (C.-B. Ben-Yelles) 
Show that it is decidable whether a type has a finite or an infinite number 
of different normal inhabitants. 


6.8.20. EXERCISE. Let Y = 71 >- — m — Q and let a be the only type 
variable occurring in y. Prove (by induction) that y is an inhabited type if 
and only if at least one of the 7;’s is not inhabited. 


6.8.21. EXERCISE. (R. Statman) 

Let p be the only propositional variable, and let — be the only connective 
occurring in a classical propositional tautology y. Show that ọ is intuition- 
istically valid. Hint: First do Exercise 6.8.20. 


6.8.22. EXERCISE. (T. Prucnal, W. Dekkers [30]) A proof rule of the form 


Tis.. Tn 
T 
is sound for IPC(—) iff for every substitution S with S(7),...S(m) all 


valid, also S(T) must be valid. Prove that if such a rule is sound then the 
implication Ti > ---— m > T is valid. 
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CHAPTER 7 


Sequent calculus 


We have seen two different formalisms for presenting systems of formal logic: 
natural deduction and Hilbert-style. Each of these has its advantages. For 
instance, in Hilbert-style proofs, there are no problems pertaining to the 
management of assumptions, whereas in natural deduction, the proofs are 
easier to discover, informally speaking. 

As we have seen earlier, both classical and intuitionistic propositional 
calculus are decidable; that is, there is an algorithm which decides, for any y, 
whether or not ¢ is classically valid (according to the truth table semantics), 
and similarly, there is an algorithm which decides, for any y, whether or not 
y is intuitionistically valid (according to the Heyting algebra semantics or 
Kripke models). By the soundness and completeness results, this result 
means that there are algorithms that decide, for any y, whether or not y 
is provable in our proof systems for classical and intuitionistic propositional 
calculus, respectively. 

This result suggests that we should be able to develop decision algorithms 
that do not make an excursion via semantics; that is, we should be able to 
read the inference rules bottom-up and turn this reading into algorithms 
that decide whether formulas have proofs in the systems. 

Anyone who has tried at least once to write down an actual Hilbert-style 
proof for even a simple formula will understand why this approach is not 
satisfactory in practice. If we want to prove a formula w, using the modus 
ponens rule 

p, p> yY 
Y 
the formula y has to be somehow chosen or guessed. And there is no bound 
for the space we make this choice from: the formula y can be anything at 
all. Any approach to automatic theorem proving based on this rule seems 
doomed to failure. 

The same problem appears in natural deduction proofs, since we also 

have the modus ponens rule there. (In addition, we have another unpleasant 
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property in the Hilbert-style system: formulas occurring in proofs are very 
long, so even if we know what to choose, such proofs are still inconvenient.) 

In this chapter we introduce a third kind of formalism, known as sequent 
calculus, for presenting systems of formal logic. Sequent calculus was intro- 
duced in the 1930’s, by Gerhard Gentzen [39], who also introduced natural 
deduction.! 

Despite similar syntax, sequent calculus and natural deduction are quite 
different and serve different purposes. While natural deduction highlights 
the most fundamental properties of connectives by its introduction and elim- 
ination rule for each connective, sequent calculus is more “practically” ori- 
ented: if one reads the rules of sequent calculus from bottom to top, the rules 
simplify the process of proof construction. Instead of introduction and elimi- 
nation rules, there are only introduction rules. Some of these rules introduce 
connectives in the conclusion parts of judgements—in fact, these rules are 
identical to the introduction rules from natural deduction. But there are 
also rules introducing connectives in the assumption parts of judgements. 
These rules replace the elimination rules of natural deduction. 

The development of sequent calculus systems has been successful not 
only for theoretical purposes: many practical approaches to automated the- 
orem proving are based on some form of sequent calculi or their relatives. 
In particular, the resolution rule can be seen as such a relative. 


7.1. Classical sequent calculus 


Although we are now mostly concerned with intuitionistic proof systems, we 
introduce a classical version of sequent calculus first. Intuitionistic sequent 
calculus is obtained from the classical one by a restriction which sheds some 
light on the relationship between these two equally fundamental logics. 

As mentioned below, many variations on the definition of sequent calcu- 
lus systems are possible; we use the systems studied by Prawitz [85, App. A], 
since these minimize the noise in the relationship with natural deduction. 
A number of variants can be found in, e.g., [109] and [38]. 


7.1.1. DEFINITION. A (classical) sequent is a pair of sets of formulas, written 
T + ©, where the right-hand side is not empty.? A proof in the sequent 
calculus is a tree labelled with sequents in such a way that mothers and 
daughters match the proof rules below. 

We write I Fas “iff fF © has a proof, and we write IT Fre iff PF E 
has a proof which does not use the rule Cut. 


‘Stanislaw Jaskowski independently introduced natural deduction systems—see 
Prawitz’ book [85], where more information about the origins of natural deduction and 
sequent calculus systems can be found. 

?Sequents with empty right-hand sides are permitted in many presentations. The 
meaning of an empty right-hand side is the same as of a right-hand side consisting only 
of L, so our restriction is not essential. 
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We use similar conventions as in the case of natural deduction. For 
instance, we write T, A for TU A, and ¢ for {vp}. 


Axiom: 


Der eA 


Rules: 


T,pF X Tyre Trg,A TRFy,A 


(RA) 
T, pAayHE T, payHE THAY, A 


T,yF E DUES ig rH y, A (RV) TEY, A 
T,pvyF E TrTFovy,A Trypvy,A 


Thy,A LARN j T, F y, A 
> 
T.ypowrAus Thy ov,A 


(R=) 


— (LL 
IFS. ) 


Try,A TFE 
PP AU 


(Cut) 


The rule (LL) has no premise and may be regarded as an axiom. The 
remaining rules, except the cut rule, are called logical rules since they define 
the meaning of the logical connectives A, V, and —. The logical rules consists 
of left and right introduction rules for every connective. The right rules are 
identical to the introduction rules from natural deduction; the left rules will 
play the role of the elimination rules from natural deduction. 

The cut rule is the only one that is neither a left nor a right rule. The 
formula y in the cut rule is called the cut formula. One can recognize a 
similarity between cut and modus ponens. 

The intuitive meaning of [+ X is that the assumptions in I imply one 
of the conclusions in ©, i.e., that p1 A... A^ Pn implies 41 V...V Ym, where 
T = {1,.-., Yn} and X = {41,... , Ym}. The rules for conjunction and 
disjunction clearly reflect this idea. 
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7.1.2. REMARK. In order to facilitate comparison with natural deduction 
we have taken | as primitive—as we have seen earlier, negation can then 
be defined by ~y = y — L. One often finds in the literature — taken as 
primitive instead. In this case, the rule (LL) is replaced by the two rules 


rF A, T,pF E 
See L) soa RI 
T,ngFA TF ~y,» 


which are derived rules in the above system. 


7.1.3. WARNING. In many presentations of sequent calculus, sequents are 
pairs of sequences (with possible repetitions) rather than sets. In such sys- 
tems one must in addition to the axiom, the cut rule, and the logical rules, 
adopt so-called structural rules, namely weakening rules that allow addition 
of formulas to the left and right of F, contraction rules that allow contraction 
of two identical formulas into one on the left and right of F, and exchange 
rules that allow changing the order of two consecutive formulas on the left 
or on the right of F. In this case one takes the axiom in the form ọ F y. 
Such a system occurs, e.g., in [46]. 

One may also use multi-sets instead of sets and sequences. In this case, 
the exchange rules are not needed. 


7.1.4. REMARK. It is not difficult to see that in the presence of weakening, 
the rules (Cut) and (L—) could as well be written as follows: 


DEVA heen REASONS 
i eS Cub) is ee 
TEA roses 


We prefer the other presentation of these rules for uniformity with the intu- 
itionistic fragment, to be defined in the next section. 


The following shows that sequent calculus is complete with respect to 
the ordinary semantics of classical logic. 


7.1.5. PROPOSITION. If © = {p1,... Yn} then we have T Htc X if and only 
if the entailment T = p1 V- -V Gp is classically valid.’ In particular, Pro L 
iff p1 V-V Yn is a classical tautology. 


The proof is omitted. Gentzen [39] proved the completeness of the se- 
quent calculus system by proving that the system is equivalent to another 
logical system. For the purposes of that proof, the cut rule is very conve- 
nient. Gentzen’s Hauptsatz then states that the cut rule is a derived rule, 
and hence the cut rule is in fact not necessary for completeness; that is, 
every application of the cut rule can be eliminated from a given proof. This 
results is also known as the Cut Elimination Theorem. We shall have more 
to say about this result in the context of intuitionistic logic below. 


3That is, iff each valuation satisfying all the formulas in T must also satisfy p1 V- - -V Pn. 
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7.1.6. EXAMPLE. Here is a sequent calculus proof of Peirce’s law: 


R—)_PE pa 
l T PT pF p 


(p> q)—> pp 


E ((p>q)—>p) > p 


Note that we sometimes have two formulas at the right-hand side. 


7.1.7. EXAMPLE. And here is another example that uses only sequents with 
one-element right-hand sides: 


- , qH 
LPP P, 4q 


pp>qFq p, p>q, rFr 
L R p p>q, q>rFr 9 
R>) p, p>q p>q>rFr 
R>) p>q, p>q>rFp>r 


p>q—>rF(p>q)>p>r 


F(p>q>r)> (p>) >p>r 
7.2. Intuitionistic sequent calculus 


The intuitionistic sequent calculus is obtained from the classical system by 
a simple syntactic restriction. We just require that only one formula occurs 
at the right-hand side of a sequent. That is, the above classical rules are 
modified so that 


e » has always exactly one element; 
e A is always empty. 


7.2.1. DEFINITION. An intuitionistic sequent is one of the form I F y, 
where y is a single formula. We write T Fe y iff T F y has a sequent 
calculus proof using only intuitionistic sequents, i.e., using only the below 
rules. We write I Fz vy if there is such a proof that does not use the rule Cut. 
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Axiom: 
T, pF g 
Rules: 

T, FH Tye [Te TF 
TrT,pAyF o TrT,pAyF o TFA 
Tr, FH Tr, yH rH rH 

Tr,pvyFo rTFový Tryvw 

[Te Tr, yH Tr, FH 

p YW 2i >) P p (R >) 

T,p>yFo TrTFo>y 

— (LL 
Tire’ ) 


Try T,ġFo 
Thro 


(Cut) 


The following shows that intuitionistic natural deduction and intuition- 
istic sequent calculus are equivalent. 


7.2.2. PROPOSITION. I FẸ g ifff En o. 


PROOF. We prove each direction by induction on the derivation of the se- 
quent. 

For the left-to-right direction, the main problem is how to express the 
left rules of sequent calculus in terms of the elimination rules of natural 
deduction, and how to express the cut rule in terms of modus ponens. 


1. The derivation of T Fe y is 
phy 


Then 
gk ey 


is also a derivation of IT Fy y. 
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2. The derivation of T HE y ends in 


Typ F y 
Tp Ayp F y 


By the induction hypothesis we have a natural deduction derivation of 
T’, yı F p. By Lemma 2.6, I’, Yi Ada, Y1 F p, sol’, pinta F Yi > 9. 
Since also I’, Wy A Y2 F Yı A we, and hence I’, Y1 A we F Y1, we get 
T’, y1 Awe F vy, by modus ponens. Thus T Fy Q. 


3. The derivation of T EF y ends in 


Tyi Pe Typ Fg 
Typy F o 


By the induction hypothesis we have derivations in natural deduction 
of T'Y F wand T’, y2 F y. By Lemma 2.6, T’, Y1, Y1 V Y2 F ọ 
and T’, Y2,%1 V Y2 F y. Since also I', y1 V p2 F pı V we, we get 
T’, yi Vyp F y. ThusT Fy y. 


4. The derivation of T ET y ends in 


P Hy Typ Fo 
Typi > yp F e 


By the induction hypothesis we have derivations in natural deduction 
IY F yy, and T’, 2 F y. By Lemma 2.6, T’, y1 > wo F Yı and 
T”, yı > p2, p2 F p. As before, I", yı > Y2 F yı > Y2, so 
T, pi > Y2 F p2. Also IT”, 4i > Y2 F p> y, so T, yi > y2 F g. 
Thus T Fy y. 


5. The derivation of T Er y is 


Pere 
Then 

jae 

Por @ 


is a derivation of I Fy y. 
6. The derivation of T ET y ends in 


Try TryF o 
TF gy 


By the induction hypothesis we have derivations in natural deduction 
ofTr F wandT,w F y. Then r F w— ọ, and then F y. Thus 
TFN y. 
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The remaining cases—the right rules—are trivial. 

For the right-to-left direction the problem is to express the elimination 
rules of natural deduction in terms of the left rules of sequent calculus; the 
cut rule turns out to be useful for this. 

As above the cases where the derivation consists of a use of the axiom 
or ends in an introduction rule are trivial. 


1. The derivation of I Fy y ends in 


TF pAw 
TF go 


By the induction hypothesis we have a sequent calculus derivation of 
T F pAw. By the axiom and the left rule for A we get T, AY F y. 
Then by the cut rule r + vy. Thus T FẸ g. 

2. The derivation of IT Fy y ends in 


Tr, yı i KA Tr, y2 F A Big W1 V we 
TF go 


By the induction hypothesis we have sequent calculus derivations of 
Tr, yı F y, of T,v2 F y, and ofTr F Yı V we. By the left rule for V 
we get T, Y1 V we F y. Then by the cut rule F vy. Thus T EE g. 


3. The derivation of IT Fy y ends in 


rF y>ypy Try 
TF o 


By the induction hypothesis we have sequent calculus derivations of 
T F Yy—yandr F y. By the axiom T, F y, so by the left rule 
for > we have that T, Y —> y F y. Then by the cut rule FT F y. Thus 
T EE Q. 


4. The derivation of [ Fy ọ ends in 


TEL 
rF o 


By the induction hypothesis we have a sequent calculus derivation of 
T F L. By the left rule for L we have T, L F y. Then by the cut 
rule I F y. Thus T Be p. O 
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7.3. Cut elimination 


In both directions of the proof of Proposition 7.2.2 we introduce detours. In 
the left-to-right direction we express the left rule for, say A, by a sequence of 
rules in which a A-introduction is immediately followed by a /A-elimination 
(this is reflected by a redex of form m;(< Mı, M2 >) in the »-term corre- 
sponding to the proof). In general we expressed each left rule of the sequent 
calculus system by a natural deduction proof in which a sequent occurrence 
was both the conclusion of an introduction rule and the major* premise of 
the corresponding elimination rule (in general, such sequent occurrences are 
reflected by redexes in the \-term corresponding to the proof). 


In the right-to-left direction we used the cut rule to express elimination 
rules in terms of left rules. 


We know that we can get rid of the detours in the natural deduction 
proofs; that is, we can transform any natural deduction proof into one in 
which no sequent occurrence is both the conclusion of an introduction rule 
and the major premise of the corresponding elimination rule. This corre- 
sponds to the fact that, by the weak normalization theorem, we can eliminate 
all redexes in a term of the simply typed A-calculus with pairs and sums. 


The following theorem states that we can also do without the cuts. 


7.3.1. THEOREM (Cut elimination). For all p andT the conditions T FE p 
and T Fz ọ are equivalent. 


The proof is somewhat tedious, especially when presented in terms of 
proof trees—see, e.g., [46] or [109]. Therefore we postpone the proof to 
Section 7.6 where a more convenient notation for proofs is developed. Here 
we merely reflect on some of the more interesting aspects of the proof, and 
consider some consequences of the theorem. 


First observe that there is no uniform way to eliminate an application of 
the cut rule, i.e., there is no fixed sequence of other rules that is equivalent 
to a cut. Each cut has to be eliminated differently, and this depends on the 
shape of the cut formula and the way it was constructed above the cut. 


In addition, in an attempt to eliminate a cut with a complex cut formula, 
i.e., one of the form y — Y, we may actually create new cuts, as can be seen 
from the following example. Consider a proof that ends with an application 
of a cut rule of the form: 


“In VE, > E, and AE the major premise is the leftmost one, the rightmost one, and 
the single one, respectively. 
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(1) (2) (3) 


jy Trg r yr 
Prey r,g> pre 
rF 


R> ) 


(Cut) 


We can eliminate this cut at the cost of introducing two new ones. This 
makes sense, because the new cut formulas are simpler. The new proof is as 
follows: 


(2) (1) (3) 


Pre  Teky 


(Cut) : 
Try T, yH v 


rH 


(Cut) 


Note that in our example the cut formula y — w was introduced just before 
the cut by the rules (R—) and (L—). 

The strategy of the cut elimination proof is as follows. The main cases, 
when the cut formula is introduced by the appropriate left and right rules 
directly before cut, is treated as in our example: by replacing the cut by 
new “simpler” cuts. Other cuts are “permuted upward” so that each cut is 
eventually either applied to an axiom (an easy case), or another main case 
is obtained. This requires an induction over two parameters: the depths of 
cuts and the complexity of cut formulas.’ 


7.3.2. REMARK. The cut elimination theorem also holds for the classical 
sequent calculus; that is, for all © and I the conditions T Era NandTI Frc X 
are equivalent. 


7.3.3. LEMMA (Subformula property). The cut-free sequent calculus Fr, has 
the following property: Each formula occurring in a proof of T F ọ is either 


a subformula of p or a subformula of a formula occurring in T. 


PROOF. By induction on the derivation of IT F y. oO 


There are a number of consequences of the subformula property. One 
is that finding a sequent calculus proof of a given formula (or finding out 
that no such proof exists) is incomparably easier than finding such a proof 
in the Hilbert, or natural deduction system. As we reconstruct the proof 


5The similarity between this approach and the proof method of weak normalization is 
not at all incidental. 
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by building the tree upward, the search space at each step is limited to 
subformulas of the formulas occurring at the present stage. This process 
cannot continue indefinitely, as the number of available formulas is bounded, 
and we will eventually repeat already considered sequents. 


7.3.4. COROLLARY (Gentzen). It is decidable, for input p, whether FẸ op. 


Another consequence is the conservativity of fragments of the calculus 
determined by a choice of connectives. The subformula property implies 
that a cut-free proof of a sequent can only mention connectives occurring 
in that sequent. Thus, e.g., a formula ((p A gq) > r) > (p > (q > r)) is 
provable in a system containing only rules for implication and conjunction. 


7.3.5. COROLLARY. IPC is conservative over its implicational fragment. 


We end this section with another proof of the disjunction property 
(Proposition 2.5.7). 


7.3.6. COROLLARY. If ee pV w then either EE y or EF w. 
PROOF. If there is a proof of EE p V Y, then there is a cut-free one. And a 


cut-free proof of a disjunction must end up with an application of rule (VI). 
Thus, either Fz, y or Fy p must have been proved first. oO 


7.4. Term assignment for sequent calculus 


Natural deduction proofs correspond to typed A-terms and Hilbert-style 
proofs correspond to typed combinators. What do sequent calculus proofs 
correspond to? 

There are several answers. The traditional one—see, e.g., [84, 118]— 
is that we can assign lambda-terms to sequent calculus proofs; that is, we 
can devise an alternative version of simply typed A-calculus—with the same 
term language, but with different typing rules—which is to sequent calculus 
what the traditional formulation of simply typed A-calculus is to natural 
deduction. 

This is carried out below. We begin with the implicational fragment. 


7.4.1. DEFINITION (Sequent calculus style A). The type and term language 
of the sequent calculus style A> is as for A (a la Curry). The typing rules 
are as follows: 
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Axiom: 
T,apra:g 
Rules: 
TFM: VT,awkN:oa Tro FM:4 ) 
> $ 
T, y: > Y F N|z := yM]: TE Az.M : pw 
rFM: Taper N: 
p 1, 7 (Cut) 


TE (àxz.N)M : 0o 


We also write Pe and Fz for derivability in this system with and without 
cut, respectively. We thus have binary and ternary version of both Hr and 
Hz; the binary version refers to the sequent calculus formulation of IPC(—) 
in Definition 7.2.1, and the ternary version refers to the present sequent 
calculus style formulation of A>. 


As usual we have that the system with terms agrees with the system 
without terms. 


7.4.2. PROPOSITION. 


(i) THEM: y then |T| FÈ ¢. 
(ii) YT ke yp then there exists M € A such that A RE M : p, where 
A= {(tp: 9) |p Er}. 


The above sequent calculus system assigns types to certain A-terms. Are 
these the same A-terms as those that receive types by the usual simply typed 
A-calculus à la Curry? The answer is no! For instance, there is no way to 
assign a type to (Ax. ày.x) (Az.z) (Az.z) in the above system. 

However, the proof of Proposition 7.2.2 implicitly defines a translation 
from terms typable in simply typed »-calculus (corresponding to natural 
deduction proofs) to terms typable in the above system (corresponding to 
sequent calculus proofs), and vice versa. 

On the other hand, if we restrict attention to A-terms in normal form, 
then the set of terms typable in traditional simply typed A-calculus coincides 
with the set of terms typable in sequent calculus. 


7.4.3. PROPOSITION. For every term M in normal form, T HE M : » iff 
T F M :ọ in simply typed A-calculus. 
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PROOF. First show that a term M is in normal form iff either 
e M is a variable, or 
e M = àx.N, where N is a normal form, or 


e M=Nly:= zP], where N and P are normal forms. 


Then the property follows easily. E 


In the correspondence between simply typed A-calculus and natural de- 
duction, -terms in normal form correspond to normal deductions (i.e., de- 
ductions where no sequent is at the same time the conclusion of an intro- 
duction rule and the major premise of the corresponding elimination rule). 

In the sequent calculus variant of simply typed A-calculus, A-terms in 
normal form correspond to cut-free proofs in sequent calculus. 


7.4.4. PROPOSITION. JfT ES M: 9, then M is in normal form if and only 
oly, M: y. 


PROOF. Obvious. O 


Thus simply typable A-terms in normal form correspond to both nor- 
mal proofs in natural deduction and cut-free sequent calculus proofs. We 
therefore have the correspondence 


Normal deductions <=> Cut-free proofs 


However, note that a deduction may use the cut rule even if the cor- 
responding A-term is in normal form (cf. Exercise 7.7.5): the substitution 
N{x := y M| may delete the term M which may contain redexes. In this 
case we just know that there is another typing that does not use the cut 
rule of the same term. 


7.4.5. REMARK. As mentioned above, the proof of Proposition 7.2.2 implic- 
itly defines a translation from terms typable in traditional simply typed 
A-calculus (corresponding to natural deduction proofs) to terms typable in 
the above system (corresponding to sequent calculus proofs), and vice versa. 

From what has been said above one might expect that the translations 
map normal forms to normal forms. However this is not the case. The reason 
for this is that in the proof of Proposition 7.2.2 we aimed at the simplest 
possible way to get from natural deduction proofs to sequent calculus proofs; 
in particular, we translated the left rules of sequent calculus into natural 
deduction proofs containing detours, and we made use of the cut rule in 
translating elimination rules into left rules. 
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7.5. The general case 


We briefly show how the development of the preceding section can be gen- 
eralized to the full propositional language. 
Recall the extension of A— à la Curry with pairs and sums: 


TEM:y TEN:ig TE M:vAgp TE M:vAgp 
Pre MNS PANY TF m(M):y r F m2(M): 9 
TEM: rF FM: 

r F in(M): yve [+ ing(M): yve 


TEL:bVoyp Tja:vdk M:p Tyy:gpt Nip 
Tr F case(L;x2.M;y.N) : p 


For completeness, extend the language with an operator € for falsity, with 
the following rule: 


TEM:1L 
Tre(M):o 


and with no reduction rule (as there is no |-introduction rule). 
First we generalize the construction in the proof of Proposition 7.4.3 


7.5.1. LEMMA. A term M is in normal form iff either 
e M is a variable, or 
e M = \z.P, or 
e M = Ply := rQ], or 


e M =< P,Q >, or 


M = in; (P), or 


M =ino(P), or 
e M = Ply := mı(x)], or 
e M = Ply := mə(x)], or 
e M = Ply := case(z; v.Q; w.R)], or 
e M=<c(P), 
where P, Q, and R are normal forms. 


PROOF. Easy. o 
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7.5.2. DEFINITION (Sequent calculus style A—> for the full language). The se- 
quent calculus style A— for the full propositional language is as for A> a la 
Curry with pairs and sums. The typing rules are are those of Definition 7.4.1 
and in addition the following: 


T,a:pyr M:o TFM: TEN: wy 
Tyy:~i1 Aga M[z:=ai(y)]):0 TE<M,N>: pry 


(LA) (RA) 
Txo FM:o0o TywktN:o TEM: 9%; 


LV 
( Tee aay A T+ in;s(M) : v1 V ge 


RV) 


T,z:L Petey oe ee) 


It is a routine matter to verify that the generalized version of Proposi- 
tion 7.4.2 holds. 

We would like now to generalize Proposition 7.4.3, but there is a problem. 
Some typable lambda-terms in normal form do not correspond to any terms 
typable in the new system. For instance, if M, N, P and Q are normal 
forms, then the term 7(case(z;z. < M,N >;y. < P,Q >)) is in normal 
form. But it has no type in the above system, even if the term is typable in 
A— with pairs and sums (to see this, observe that no rule could possibly be 
the last one used.) 

One way to remedy this problem is to modify the term assignment for 
the (Cut) rule to: 


TFM: T,aprN:oa 


PEN |e = M]: (eu 


Then our example term can be typed, but only using the cut-rule, so the 
correspondence between normal proofs and cut-free proofs has been lost. 

Incidentally, this difficulty does not occur for implication and conjunc- 
tion, but only for the disjunction and falsity. The reason is that the elimina- 
tion rules for these connectives are different. Recall that every elimination 
rule has a main premise involving the eliminated connective. In case of 
implication and conjunction, the conclusion of the elimination rule (more 
precisely: the right-hand side of the conclusion) is a subformula of the main 
premise. In case of disjunction and falsity this is not the case. 

Our example term corresponds to the following sequence of proof steps: 
conjunction introduction (pairing) followed by disjunction elimination (case), 
followed by conjunction elimination (projection). Due to the “irregular” be- 
haviour of disjunction elimination, the last projection should actually be 
applied to the pair(s) created at the beginning. But the case instruction 
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makes this impossible. It is a stranger who entered here by mistake due to 
an improperly closed door (the “bad” elimination, as Girard calls it) and 
does her own work quite unrelated to the form of the main premise. A so- 
lution is either to ignore her or to open the door even more and let her go 
out. Technically, these two alternatives mean that we should either relax the 
existing reduction rules to allow for reduction of introduction/elimination 
pairs, even if the latter does not immediately follow the former, or we should 
introduce commuting conversions, i.e., reduction rules to permute elimina- 
tions. 
After Girard [46] we take the second option. 


7.9.3. DEFINITION. In A— with pairs and sums let —, denote the union 
of — , of the G-reductions for pairs and sums (see Page 75), and of the 
compatible closure of the relation defined by the following rules: 


© m(case(M;x.P;y.Q))  case(M; a.m (P); y.m1(Q)); 
© m2(case(M; x.P; y.Q)) > case(M;a.119(P); y.19(Q)); 
e (case(M;2x.P;y.Q))N = case(M;x.PN;y.QN); 
o <(case(M;x.P;y.Q)) > case(M; x.e(P); y.e(Q)); 


e case(case( M; x.P; y.Q);z.N;v.R) > 
case( M; x.case( P; z.N; v.R); y.case(Q; z.N; v.R)); 


e case(e(M); x.P;y.Q) > e(M). 
Also, let NF, denote the set of normal forms with respect to >e. 
Now we can state a version of Proposition 7.4.3. 


7.5.4. PROPOSITION. For every M € NFe: THEM: 9 ifff F M : g in à> 
with pairs and sums. 


For the full system we also have 


7.5.5. PROPOSITION. For every deduction T En M : 4, M is in c-normal 
form if and only if T Fr M : ¢. 
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PROOF. Obvious. oO 


7.5.6. REMARK. The notion of ņ-reduction is often understood as follows. 
An elimination followed by an introduction of the same connective should 
be ignored. We can write the following eta-rule for A: 


< ™(M),72(M) >—>ņ M. 


The above rule, although looking very convincing, hides an unpleasant sur- 
prise to be discovered in Exercise 7.7.6. 

For function types, as we have already observed before, the meaning of 
the eta rule is the postulate of extensionality for functions, In case of A, 
eta-reduction has the following meaning: Every object of a product type is 
actually a pair. 

This leads to the idea of the following “generalized extensionality” prin- 
ciple: Every object should be assumed to be in a “canonical form”. The 
canonical form for an object of type ø V T is a variant, i.e., it is either an 
inı(M) or an ing(N). Thus suggest the following eta rule for disjunction: 


case( M; x.iny (x); y.ine(y)) > M. 


7.5.7. WARNING. We use logical symbols V and ^ to denote also the corre- 
sponding types. Similar symbols are often used to denote intersection and 
union types, which have quite a different meaning (see e.g. [6]). Our A is ac- 
tually a product rather than intersection, and our V is a variant type rather 
than set-theoretic or lattice union. 


7.6. Alternative term assignment 


The sequent calculus systems with terms in the preceding two sections reveal 
interesting connections about normal natural deduction proofs and cut-free 
sequent calculus proofs. 

However, for a fine-grained analysis of cut-elimination the term assign- 
ment is not satisfactory. The problem is that different proofs correspond to 
the same term so that reductions on proofs is not exactly mirrored by reduc- 
tions on terms. In this section we follow another well-known approach—see, 
e.g., [15, 116, 38]—and introduce another, more explicit, way of assigning 
terms to sequent calculus proofs. We shall use the term assignment to prove 
the Cut Elimination Theorem. 

Yet another approach to term assignment appears in [52]. 
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7.6.1. DEFINITION (Alternative term assignment to sequent calculus). We con- 
sider the language of propositional formulas and the following term language: 


M := a |ini(M)|ino(M)|Arv.M| < M,M'> 
elx) 

case(x; z". M"; x".M") 

let z = 2’ M in M’ 

let x = mı (x') in M' 

let z = 79(z’) in M’ 

let? x = M’ in M' 


Note that in the first three kinds of let-expression, the form of N in the 
expression “let x = N in M” is restricted to certain forms. 
The inference rules of the system are as follows: 


Axiom: 


T,x:yF z:o 


Rules: 


TFM: T,yryF N:o Txo F M:4 R>) 
> x 
Tygowrletx=yMinN:o TRFAta.M: pw 


T,x:9¢;- M:o TrFM:¢9 EE as 
T,y:91 A p2 F letx=a(y)inM:o TK<M,N>: pA 


(LA) 


T,xyFM:0o TywkN:o TEM: 9; 
T,z:9 V% F case(z;2.M;y.N):0 T+ ing(M): y1 V ye 


(Lv) 


T,z:L Felz): o ue) 


TrFM:9 T,aprNn:o 
TRlett?x=MinN:o 


(Cut) 


In A-terms with pairs and sums there are a number of constructors and 
a number destructors. The constructors are < e,e >, inj(e), and Az.e; these 
build up values, informally speaking. The destructors are case(e; x.M; 2’.M’), 
e N, and 7;(e). These inspect and dissect values, informally speaking. In 
the A-calculus with pairs and sums one can freely apply a destructor to any 
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term. The main difference to the above term language is that now the com- 
bination of destructors and constructors are expressed via an explicit rule, 
namely cut. 

This makes it very explicit where intermediate results, e.g. a pair of 
which one takes a projection, are constructed. In functional programming 
there are various techniques to eliminate intermediate data structures from 
functional programs, notably Wadler’s deforestation [115]. Marlow [69] stud- 
ies deforestation of a functional programming language which is similar to 
the term assignment for sequent calculus proofs. 

The following rules remove cuts from sequent calculus proofs represented 
by the alternative syntax of Definition 7.6.1. 


7.6.2. DEFINITION. On the term language introduced in Definition 7.6.1, 
we introduce the relation —, as the transitive, reflexive, compatible closure 
of the relation defined by the following rules, which are divided into three 
groups: main cases, absent constructor in left term, and absent constructor 
in right term. 

The main cases are: 


let P1492 y =< Mı, Mo > in let xz = m;(y)in M —> 
let f: x = M; in M 
let ¥1Y2 y = in;(M) in case(y; x1. M1; £2.M2) ig 
let %# ti = M in Mi; 
let 9172 y = Ax.M inlet z=yNin L = 
lett x = N in let? z= M in L 


Absent constructor from left hypothesis: 


let? z = y in N — N{x:= y} 
let? x = let y = m;(z) in M in N — let y = m;(z) in let? z = M in N 
let? x = case(z; y1.Mı; y2.M2) in N > 

case(z; y1.let? z = Mı in N; y2.let? z = Mı in N) 
let? x = let y= z M in K in N —> let y= z M in let? xz = K in N 
let? x = lett” y= M in Kin N — let” y= M in let? z = K in N 
let? x = e(y) in N — e(y) 


Absent constructor from right hypothesis: 


lett? r=Niny — y{x:= N} 
let? c= Nin < Mı, Mo > = 

< let? c= N in Mj, let? x = N in Mo > 
let? x = N in in,(M) — in,(let? c= N in M) 
let? c= N in Ay.M > dAylet? c= Nin M 
let? x = N in e(y) — e(y) 


let? z= N inlett y=KinL > 
let? y = (let? z = N in K) in (let? z = N in L) 
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7.6.3. DEFINITION. 


1. Define the degree d(y) of a formula y by: 
d(l)=d(a)=0, forae PV; 
and 


dp A) = dev 4) =dy— 4) =1+max{d(y), d()}. 


2. Define the degree d(M) of a term M as the maximal degree of any y 
in any let? c= K in Lin M. 


3. Define the height h(M) of a term M as the height of M viewed as a 
tree. 


7.6.4. LEMMA. Let d= d(Y) and assume 
Tet lett? c=MinN: 


where d(M) < d and d(N) < d. Then let? x = M in N —, P for some P 
with T HE P:w and d(P) < d. 


Proor. By induction on h(M) + A(N). Split into cases according to the 
form of M and N. oO 


7.6.5. PROPOSITION. If T FE M : p and d(M) > 0 then M —, N for 
some N with FÈ N : p and d(M) > d(N). 


PRroorF. By induction on M using the lemma. oO 


7.6.6. THEOREM (Gentzen). IFT HE M:y then M—, N wherer FE N: 9 
and d(N) = 0, i.e., N represents a cut-free proof. 


Proor. By induction on d(M) using the Proposition. O 


What does the system introduced above correspond to, computationally 
speaking? The rules are similar to the rules that one finds in systems for 
explicit substitution—see, e.g., [14]. It would be interesting to investigate 
this in greater detail—this has been done recently [113]. 
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7.7. Exercises 


7.7.1. EXERCISE. Give sequent calculus proofs for the formulas of Exam- 
ple 2.2. To prove the odd-numbered formulas use only sequents with single 
formulas at right-hand sides. 


7.7.2. EXERCISE. Show that all cut-free proofs for the even-numbered for- 
mulas of Example 2.2 must involve sequents with more than one formula at 
the right-hand side. 


7.7.3. EXERCISE. Design a sequent calculus allowing empty right-hand sides 
of sequents. Does it make sense now to have a right rule for L? 


7.7.4. EXERCISE. Prove Proposition 7.4.3. On the basis of this proof de- 
scribe algorithms translating a normal deduction into a cut-free proof and 
conversely. 


7.7.5. EXERCISE. Give examples of cuts that are assigned terms in normal 
form, according to the term assignment of Section 7.4. 


7.7.6. EXERCISE. Show that the Curry-style variant of lambda-calculus with A 
does not have the subject reduction property for 7-reductions. Show that 
the eta rule for V has the subject reduction property. 


7.7.7. EXERCISE. Design a Church-style calculus with A and V and show 
that subject reduction property holds for that calculus. 


7.7.8. EXERCISE. Explain the difference between the above two results. 


7.7.9. EXERCISE. Can you design a reasonable eta-rule for disjunction aim- 
ing at erasing elimination-introduction pairs? Why not? 


7.7.10. EXERCISE. Define an eta-rule for L. 


7.7.11. EXERCISE. Let A denote the term language of Definition 7.6.1, ex- 
cept that in A, cut terms have the form let* « = M in N (the ¢ is omitted). 
Let L denote the set of A-terms with pairs and sums and e€. 

Let Fz denote typability in A— with pairs and sums and L, and let F4 
denote typability in the sense of Definition 7.6.1 with the obvious modifica- 
tion to the cut rule to accomodate the change in the syntax of cut terms. 

Let —»4 denote the reduction relation from Definition 7.6.2, and let —»z, 
denote the transitive, reflexive closure of —g plus the reductions on pairs 
and sums. =, and =, are the obvious closures. 

Use the proof of Proposition 7.2.2 to give translations tr : A — L and 
ta : L — A between A and L. Note that these can also be viewed as 
translations on type-free terms. 

Which of the following properties hold for your translations? 
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1. TH Mey 6 Thy tae 
2. TFAM: Tez tr(M): g; 
3. My, N = ta(M)—a ta(N); 
4. M—»4 N & ti(M)—ır tr(N); 
5. tr(t4(M)) =, M; 
6. ta(tr(M)) =a M. 


What happens if you add commuting conversion to the relations >£, =z, 
etc.? 


CHAPTER 8 


Classical logic and control operators 


In the previous chapters we have encountered the Curry-Howard isomor- 
phism in various incarnations; each of these state a correspondence between 
some system of typed terms and a system of formal logic. 

Until now these systems of formal logic have been constructive; that is, 
in none of them have we found the principle of the excluded middle or the 
double negation elimination principle that one finds in classical logics. 

This is by no means a coincidence. Until around 1990 there was a 
widespread consensus to the effect that “there is no Curry-Howard isomor- 
phism for classical logic.” However, at that time Tim Griffin made a path- 
breaking discovery which have convinced most critics that classical logics 
have something to offer the Curry-Howard isomorphism. 

In this chapter we introduce classical propositional logic, we study how 
one can assign terms to classical proofs, and we present a system for classical 
proof normalization. The connection between classical and intuitionistic 
logic is also elaborated in some detail. Griffin’s discovery is then presented 
at the end of the chapter. 


8.1. Classical propositional logic, implicational fragment 


Although the bulk of the previous chapters have been concerned with formu- 
lations of intuitionistic propositional logic we have occasionally come across 
classical propositional logic. 

For instance, in Chapter 2, we briefly studied the algebraic semantics of 
classical logic, and in the preceding chapter, we introduced sequent calculus 
for intuitionistic logic as the restriction of classical sequent calculus to one- 
formula right hand sides. 

In the case of natural deduction, there are several ways to obtain classi- 
cal propositional logic from intuitionistic propositional logic. The following 
gives one way of doing this for the implicational fragment. 
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8.1.1. REMARK. In order to avoid confusion and lengthy remarks it is con- 
venient in this chapter to have available a systematic way of assigning names 
to subsets of the language of propositions and to logical system and typed 
A-calculi. 

In this chapter, L(—) denotes the set of implicational formulas, i.e., the 
language generated by the grammar: 


L(>) a gu= llalypoy 


The full propositional language L(—,\V,/) is the language generated by 
the grammar: 


L(>,V,A)a¢2=Llalepoy'levy'|pag 


We shall occasionally be concerned with the set L~(—) of pure implica- 
tional formulas, i.e., the language generated by 


L (>)>¢y:=a]| y> y 


Similarly, the pure full propositional language L~(—,V,/) is the lan- 
guage generated by the grammar: 


L-(3,V,A) a ¢2=alyoy'l|evy'| pay’ 


We will follow similar naming conventions for logical systems and typed 
A-calculi. 


8.1.2. DEFINITION (Classical propositional logic, implicational fragment). Let 
p,p range over implicational formulas, i.e., over L(—). As usual, T and A 
denote contexts for which we use the standard conventions. 

The natural deduction presentation of the implicational fragment CPC(—) 
of classical propositional logic is defined by the following axiom and rules: 


Axiom: 
T, pF g 
Rules: 
oo a 
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8.1.3. PROPOSITION. Let y be an implicational formula. Then T F o iff 
T = ọ according to the truth-table semantics. In particular F p iff p is a 
tautology. 


ProoF. The proof is left as an exercise. oO 


8.1.4. REMARK. A small variation of the system is obtained by changing 
rule (~~E) to 
TF(polyol 
Try 
It is an easy exercise to see that this change does not affect the set of 
provable sequents, i.e., IT F y can be derived in the original system iff T F y 
can be derived in the modified system. 


(=E) 


Since ~g is defined as y — L a shorter way to express the formula in the 
hypothesis is ~——~ọ, which explains the name double negation elimination. 


8.1.5. REMARK. In CPC(-—) one can prove every formula that can be proved 
in IPC(—), the implicational fragment of intuitionistic propositional logic. 
The latter system contains the axiom and the rules (>I), (~E) and (LE), 
so the only problem is to show that (LE) holds as a derived rule in CPC(—). 
That is, that we have to show that in CPC(—), 


Feebs Tkp 


for any y. In fact, this is easy. If IT F L then also T,y — Lt L by an easy 
weakening lemma, and then T F » by (77E). 


8.1.6. REMARK. Another way to define CPC(—) is to consider the axiom 
along with rules (I) and (—E) and then the following two rules: 
Ce a) TRL 


Try = T 


The left-most rule is called Peirce’s law, and the right-most one is called 
ex falso sequitur quod libet (from absurdity follows whatever you like). 
An alternative is to consider instead the following two rules: 


In other words, in the presence of (LE), Peirce’s law and the special case 
yw = L are equivalent. 

It is an exercise to show that these two systems derive the same sequents 
as the system introduced in Definition 8.1.2. 
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8.1.7. REMARK. In the case of Hilbert-style proofs there are also several 
ways to obtain classical logic from intuitionistic logic. For instance, if one 
takes absurdity as primitive, one can add to the two axioms (A1) and (A2) 
of Section 5.3 the principle of double negation elimination: 


(Y > 1) > 1) > y. 
Another possibility is to add Peirce’s law in the form 
(Y > 4) > Y) > y, 
together with ex-falso in the form: 
A — y. 


8.1.8. REMARK. If one takes negation as primitive in a Hilbert-style system, 
one can add to the axioms (A1) and (A2) the third axiom: 


Cy > nv) > y > 4) > y, 


which is read: “if ~y implies both w and ~y, then it is contradictory to 
assume =g, so y holds.” 
In case negation is taken as primitive one cannot simply add 


=p > p (*) 


This may seem a bit strange since above we suggested to add exactly this 
axiom when ~ is defined in terms of L. The point is, however, that in 
defining — in terms of L we get certain extra axioms for free. For instance, 
we have above the rule 


(p = 4) = (> (4> 1)) > (> 1) 


and the corresponding axiom 


(p> Y) > (y > 4) > ~Y 


does not follow from axioms (A1) and (A2) and the double negation ax- 
iom (x). 

Similar remarks apply to natural deduction systems in which negation 
is taken as primitive. 


Apart from classical propositional logic and intuitionistic propositional 
logic, there are many other similar propositional logics, although none of 
them are as fundamental as these two. One can show that classical propo- 
sitional logic is a maximal logic in the sense that, for any axiom scheme g, 
either y is a theorem of classical propositional logic, or addition of y to 
classical propositional logic would render the system inconsistent. Such 
properties are usually known as Hilbert-Post completeness. 
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8.2. The full system 


In the previous section we were concerned with the implicational fragment 
of classical propositional logic. What is required to obtain a definition of 
the whole system with conjunction and disjunction? 

One approach is to add to the language the two connectives A and V and 
adopt the introduction and elimination rules of the system of Section 2.2. 


8.2.1. DEFINITION (Classical propositional logic). Let y,w range over for- 
mulas in the full propositional language, i.e., over L(—>,V,^). As usual, T 
and A denote contexts for which we use the standard conventions. 

The natural deduction presentation of CPC(—,V, A), classical proposi- 
tional logic, is defined by same rules as in Definition 8.1.2 with the addition 
of the following well-known rules. 


Te rF TFA TFA 
p ani p VIAE) phy 
TrypAw Try TFw 
Te Te TyF T,we Te 
Pow Y “pro Tyra UN ie) 
Trypvwy rTFový Tho 


The above addition does not change anything concerning implicational 
formulas. 


8.2.2. PROPOSITION. If p € L(—>) and- » in CPC(—,V,A), then in 
CPC(-). 


PROOF. Left as an exercise. oO 


In other words, the full system is conservative over the implicational frag- 
ment. 

However, there is a more economical approach. In contrast to the sit- 
uation in intuitionistic propositional logic, we may define conjunction and 
disjunction as derived connectives. 


8.2.3. DEFINITION. Let y Aw and y V w abbreviate the following formulas, 
respectively: 

p^ = (p>4=>1)> l1; 

ẹyẹ = (>=1)>@=>=1)->1. 


8.2.4. REMARK. The above definition of y V w is not standard; one usually 
takes pVw = (y — L) —> y. This definition lacks the double negation on w. 
From a logical point of view this is of little importance, since in classical 
logic we can pass back and forth between a formula and its double negation. 
However, the abbreviations in Definition 8.2.3 are more systematic since 
they arise as special case of a general scheme for representing data types in 
typed A-calculi, as we shall see later. 
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The following states that our definition of A and V have the intended 
behaviour. 


8.2.5. PROPOSITION. Let p E€ L(-,V,A) and and let p! € L(—) be the 
implicational formula obtained by replacing every occurrence of ^ and V by 
their defining formulas according to Definition 8.2.3. ThenT H g iff = ọ. 


PROOF. By completeness [+ vy’ iff Tr | vy’. By elementary calculations 
with truth tables, PE y’ iff T E y. o 


8.3. Terms for classical proofs 


In what way can we extend the Curry-Howard isomorphism to classical 
propositional logic? In one sense this is easy: we just add a new term 
constructor Ax.M (or Ax: p.M in the Church variant of the calculus) in the 
conclusion of the double negation elimination rule. 


8.3.1. REMARK. It is convenient in this chapter to have available a system- 
atic way of assigning names to subsets of the language of A-terms with pairs, 
etc. 

Recall that A denotes the set of A-terms, i.e., the language generated by 
the grammar: 

A> M::=2|Ar.M|M M' 

The set of A-terms, extended with pairs and sums, A(7;,in;) is the lan- 

guage generated by the grammar: 


A(t; in) D M = a2|dAr.M|M M'| < M,M'> |7,(M)| 
in;(M) | case(M; x’.M’; x”.M”) 
We shall occasionally be concerned with the set A; generated by 
As D M:=2|Ar.M|M M'|e(M) 
Similarly, we have the language generated by the grammar: 
A-(m,inj) D M == x2|dAr.M|M M'| <M,M'> |7,(M) 
| in;(M) | case(M; 2’.M"; 2”.M") | e(M) 
>) 


8.3.2. DEFINITION (type-free and simply typed A,q-calculus, Aa (—>)). The term 


language A, of type-free A,-calculus is defined by the grammar: 
Aa D M £= g | àxz.M | M M' | Av.M 


The simply typed A,-calculus has as type language the set L(—). The 
inference system of simply typed A,q-calculus arises from the system of sim- 
ply typed A-calculus à la Curry by addition of the rule 


Tr,x:ọy>LFM:1 
TF Aw.M:¢ 


8.4. Classical proof normalization 133 


8.3.3. REMARK. In the Church variant the obvious modifications are made 
to the term language and to the inference rules. In particular, the double 
negation elimination rule becomes 


Prr = LEM yd 
TrArypo>L.M:¢9 


We then have the usual correspondence (where binary F means deriv- 
ability in CPC(—) and ternary F means typability in simply A,-calculus à 
la Curry): 


8.3.4. PROPOSITION. 
(i) fT | M:o then |[| + p, where |T| = {y| da: (x: vy) Er}. 
(ii) fT H © then there exists an M such that IY | M : oy, where 
Pap ie pe Lh. 
The assignment of Axv.M to the double negation elimination rule only 
extends the Curry-Howard isomorphism to classical logic in a very naive 


sense: we still have no idea what the computational significance of A is. 
However, we shall learn more about this in Section 8.7. 


8.4. Classical proof normalization 


As we have seen in previous chapters, reduction on proofs is a rather im- 
portant concept in the proof theory of intuitionistic logic; for classical logic 
the same is the case, and we now present certain reductions on classical, 
propositional proofs that have appeared in the literature. 

The following gives reductions on Aa-terms à la Church. The corre- 
sponding reductions on A,a-terms a la Curry are obtained by erasing all 
type annotations. 


8.4.1. DEFINITION. Define the relation —, on A, à la Church as the small- 
est compatible relation containing the following rules: 


(Az:-=(y > ¥).M)N >a Azirnw.M{e:=dAy:~p > Y . z (y N)}; 
Az: 7y.2 M >a M provided z ¢ FV(M); 
Az: ~ng.x Ay: AGN >a Az:ny.N{z,y := z}. 


where {e := e} denotes substitution on Aa-terms defined in the obvious way, 
and the notion of compatibility is taken in the obvious way relative to the 
set An. We use the notation NF, etc with the usual meaning. 


From the point of view of reduction on proofs, the first of these rules 
decreases the complexity of formulas to which we apply the double negation 
elimination rule. The second rule may be regarded as a form of 7-rule for A. 
The third rule reduces applications of the double negation elimination rule 
nested in a certain trivial way. 
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8.4.2. WARNING. The reader should be warned that one finds in the liter- 
ature different typed A-calculi corresponding to classical logic that are not 
merely simple variations of the above one. This is in particular true for the 
system studied by Parigot—see, e.g, [82]—which is one of the most widely 
cited approaches. 

Also, different authors use different symbols for the term corresponding 
to variants of the double negation elimination rule, e.g.  (Parigot [79, 80, 
82, 81], Ong [78]), y (Rezus [91, 92]), and C (Griffin [49] and Murthy [75, 76]); 
the A is taken from Rehof and Sørensen [89]. 


8.4.3. REMARK. In the literature one finds different sets of reduction rules 
for classical proofs, although almost every set contains a variant of the first 
of the above rules. 


The following gives a characterization of the normal forms of GA-reduction, 
i.e., a characterization of classical proofs without detours. 


8.4.4. DEFINITION. Let M be the smallest class of \a-terms closed under 
the rule: M1,..., Mn E N => Azy....Atyn.Ay.... AYm.z Mı... Mp EN 
where n,m > 0 and z may be an 2;, a yj, or some other variable. 


8.4.5. PROPOSITION. IfT H M : yọ in simply typed [a -calculus, and M € NFga, 
then M EN. 


PROOF. By induction on the derivation of TF M : y. O 


The proposition states that any normal proof proceeds by first making 
certain assumptions (reflected by the variable z), then decomposing those 
assumptions into simpler formulas by elimination rules (reflected by the 
applications z Mı... Mn), then using on the resulting formulas some ap- 
plications of the double negation elimination rule (reflected by Ay;.e), and 
finally by building up from the result more complicated formulas again by 
introduction rules (reflected by the abstractions \x;.¢). 

The following shows that the reduction rules are sufficiently strong that 
the characterization of their normal forms entails consistency of the system. 


8.4.6. COROLLARY. |/ L. 


Proor. If F L then + M : L for some closed M. By the strong normal- 
ization theorem—which will be proved later—we can assume that M is in 
normal form. Then by induction on the derivation of M € N show that 
+ M : L is impossible. oO 
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8.5. Definability of pairs and sums 


We saw in the second section above that one can define conjunction and 
disjunction in classical propositional logic. Intuitively speaking, at the level 
of terms, this suggest that we should be able to define pairs and sums. In 
this section we show that this is indeed possible. For simplicity we work in 
this section with Aq-terms à la Curry. 

First we introduce the extension that corresponds to the full system 
CPC(—,V,A). 


8.5.1. DEFINITION. The term language A,(7;,in;) of type-free Aa-calculus 
extended with pairs and sums is defined by the grammar: 


Aalmi in) D M == a2|dAv.M|M M'| <M,M'> |7,(M) 

|  in;(M) |case(M; x'.M'; 2”.M") | Av.M 
The simply typed A,-calculus extended with pairs and sums, denoted by 
Aa(—,V,/), has as type language the set L(—,V,/). The inference system 


of Aa(—,V,A) arises from that of Aa (—>) by addition of the usual rules à 
la Curry for typing pairs and sums. 


The following shows how to define pairs and sums. 


8.5.2. DEFINITION. Define the following abbreviations. 


< P,Q > = Xz.2PQ; 
mil P) = ARP (ADAG £i); 
in;(P) = Xyi.Ay2-yi P; 


case(P; 21.Q1;%2.Q2) = Ak.P (Az1.kQ1) (At2.kQ2). 
By some elementary calculations, one can then prove the following. 


8.5.3. PROPOSITION. Let M € Aa(mi, ini) and let M’ € Aa (Ti, ini) be the 
term obtained by expansion according to the abbreviations in the preceding 
definition. Let p € L(-,V,A) and let y’ € L(-) be the formula obtained by 
replacing every occurrence of \ and V by their defining formulas according 
to Definition 8.2.8. 


1. IfT EM: ọ in simply typed [s -calculus extended with pairs and sums, 
then T- M’: g in the simply Aa -calculus. 


2. If M —>ga N (using reductions for pairs and sums) then M'—»ga N', 
where N’ is the expansion of N according to the preceding definition. 


The definition of pairs is the standard one from type-free A-calculus (see 
Chapter 1), while the projection construction is different from that normally 
employed in type-free A-calculus, viz. M (Ax ,.Ar2.2;). This latter definition 
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does not work because Ax1.A%9.2; has type y1 — p2 — Yi instead of the type 
pı > p2 —> L, which M expects. Changing the definition of conjunctive 
types to solve the problem is not possible; it leads to the type of a pair 
being dependent on which component a surrounding projection picks.! The 
operator A solves the problem by means of an application which turns the 
type of x; into L regardless of i. When the projection is calculated, the k 
reaches its A and can be removed by the second reduction rule for A: 


T1(< Mı, Mo >) = Ak. (AF. f Mı Mə) AX .AL2.K £1 
>B Ak.(Az1.A£2.k zı) Mı Mo 
—>8 Ak.k Mı 
>a Mı 


As mentioned earlier, the definition for disjunctive formulas above is 
not standard in logic. The standard definition is (p —> L) — w instead 
of (p — L) — (y — L) — L. However, when one tries to prove the de- 
rived inference rules for this translation it turns out that the corresponding 
constructions for injection and case analysis are very different from those 
defining pairs and projections. Specifically, to have the desired reduction 
rule hold derived one would need to add extra power to A. The present 
definition and corresponding defined constructions can be motivated by cor- 
responding definition in second-order logic, which we will encounter in a 
later chapter. 


8.6. Embedding into intuitionistic propositional logic 


In this section we shall show that classical logic can be embedded into intu- 
itionistic logic in a certain sense. 

Translations like the following have been studied since the 1930s by Kol- 
mogorov, Gentzen, Gödel, and Kuroda. 


8.6.1. DEFINITION. Define the translation k from implicational formulas to 
implicational formulas by: 


kp) = (ky) > kW) 


We aim to show that if y is classically provable, then k(y) is intuition- 
istically provable. We do this by giving a translation of classical proofs of 
y into intuitionistic proofs of k(y). More precisely, the translation is stated 
on terms representing these proofs. 


If one is willing to settle for a weaker notion of pairs where both component must 
have the same type, then this problem vanishes. This shows that pairs with components 
of the same type can be represented in the simply typed -calculus. 


8.6. Embedding into intuitionistic propositional logic 137 


8.6.2. DEFINITION. Define the translation t from Aa-terms to A-terms by: 


t(x) = Abe k 

t(Av.M) = Ak.k Ax.t(M) 

t(M N) = Ak.t(M) (Am.mt(N) k) 

t(Av.M) = Ak.(Axt(M))(Ah.h Aj.Aii (j k)) àz.z 


The following shows that k defines an embedding of classical logic into 
intuitionistic logic. 


8.6.3. PROPOSITION. IfT H M : » in simply typed \q-calculus, then k(T) F 
t(M) : k(p) in simply typed A-calculus. 


This gives another proof of consistency of classical propositional logic: if 
classical logic is inconsistent, so is intuitionistic logic. 


8.6.4. PROPOSITION. y L in classical propositional logic. 
Proor. If} M : L in classical propositional logic, then F t(M) : 371 


in intuitionistic logic, and then | t(M) Az.z : L in intuitionistic logic, a 
contradiction. o 


The above proof gives a conservativity result: if L is provable in classical 
logic, L is provable already in intuitionistic logic. The construction can 
be generalized to other formulas than L; in fact, this way one can prove 
that any formula of form Vrdy : P(x,y), where P is a primitive recursive 
predicate, is provable in classical arithmetic (i-e., Peano Arithmetic) iff it 
is provable in intuitionistic arithmetic (i.e., Heyting Arithmetic). Formulas 
of this form are quite important since they include, e.g., every assertion 
that some algorithm terminates (“for any input x there is a terminating 
computation y”). In other words, as concerns provability of termination of 
algorithms there is no difference between intuitionistic and classical logic. 

On the one hand, this means that constructivists should raise no ob- 
jection to the use of classical logic in this special case since any classical 
proof can be converted into an intuitionistic one of the same formula. Con- 
versely, classical logicians cannot claim that any logical strength is lost by 
the restriction to intuitionistic logic. 

The following shows that the translation t internalizes A conversion by 
(G-conversion. 


8.6.5. PROPOSITION. If M =ga N then t(M) =, t(N). 


By analyzing the connection between A and (@ in some more detail, one 
can prove: 


8.6.6. PROPOSITION. If M € coga then t(M) € œg. 


138 Chapter 8. Classical logic and control operators 


8.6.7. COROLLARY. The relation —>ga is strongly normalizing on typable 
terms. 


PROOF. By the preceding proposition, Proposition 8.6.3, and strong nor- 
malization of simply typed A-calculus. oO 


8.7. Control operators and CPS translations 


So far we have not revealed what the computational meaning of A is; in this 
section we finally release the suspension: A is a control operator! 

Control operators appear in functional programming languages like Scheme 
(Call/cc), ML (exceptions), Lisp (catch and throw). 

Let us illustrate, by way of example, how control operators can be used to 

program efficiently and concisely. We shall consider the problem of writing 
a function M which takes a binary tree of integer nodes and returns the 
result of multiplying all the node values. Of course, this problem raises the 
efficiency issue of what to do when a node value of 0 is encountered. 
Our example programs will be written in syntactically sugared SCHEME, 
the sugar being that instead of (define M N) we write M = N and in- 
stead of (lambda (x) M) we write A x.M, and for (letrec ([f t]) t’) 
we write (let f = t in t’). 

Our first solution is the straightforward purely functional one which 
trades efficiency off for elegance. We suppose given auxiliary functions mt? 
testing for the empty tree, num selecting the node value of the root node, 
1son and rson returning the left and right subtrees. 


8.7.1. EXAMPLE. (Functional, elegant, inefficient version) 
M1 = At. (if (mt? t) 
1 
(* (num t) (* (M1 (lson t))) (M1 (rson t))))) 


One can optimize M1 so as to stop multiplying as soon as a node value of 0 is 
encountered. This can be done in purely functional style, by means of tests. 
Our next solution embodies that strategy. Here we assume a constructor 
EX and a test function EX? such that (EX M) tags M with the marker EX, 
and EX? tests for the presence of the tag. Furthermore, we assume a 0 test 
function zero?. The reader will probably agree that elegance (or at the 
least conciseness) has now been traded off for efficiency. 


8.7.2. EXAMPLE. (Functional, inelegant, efficient version) 
M2 = At. Cif (mt? t) 
1 
(if (zero? (num t)) 
(EX 0) 
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(let ((1 (M2 (lson t)))) 


(if (EX? 1) 
(let ((r (M2 (rson t)))) 
(if (EX? r) 
r 


(* (num t) (* 1 r)))))))) 


The function M2 will return an integer, the product of all the tree nodes, if 
no node contains 0, or the value (EX 0) if any node contains 0. We may 
see the EX tag as a kind of exception marker which is propagated explicitly 
up the recursion tree. In this vein one could view the EX constructor as an 
injection function taking an integer to an element of a sum type of the form 
int V ex. Now, the catch/throw mechanism is well suited to handle exactly 
this kind of problem where an exceptional value is propagated. Efficiency is 
enhanced by catch and throw because all the propagation is done in a single 
step (or jump, as we might say). This leaves us with a relatively elegant and 
efficient but non functional version, as shown in the next example program. 


8.7.3. EXAMPLE. (Non functional, elegant, efficient version) 
M3 = At. catch j in 
(let L = At Gt (mt? t’) 


1 
(if (zero? (num t’)) 
(throw j 0) 
(* (num t°) 
(* (L (lson t’))(L (rson t’)))))) 
in (L t)) 


It is an interesting fact that the mechanism used in Example 8.7.3 can be 
internalized in the purely functional part of the language by the so-called 
CPS-transformation technique. Applying that translation to the program 
with catch and throw gives: 


8.7.4. EXAMPLE. (CPS version of M3) 
M4=At. Ak. 
(if (mt? t) 
(k 1) 
(if (zero? (num t)) 
(0) 
((M4 (lson t)) 
(A. 1.((M4 (rson t)) 
(A r.(k (* (num t) (* 1 r))))))))) 


The non-functional program can be written as follows in the type-free 
Aa-calculus. 
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Me AGG 
(Y (AFA. Gf (mt? t) 
1 
(if (zero? (num ť)) 


e(j 0) 
(* (num 7’) 


(* (f (son t’))(f (rson t’))))))) t), 


where Y denotes Church’s fixpoint combinator and e(M) abbreviates Ax.M, 
for x g FV(M). 

It is instructive to verify that, e.g., for T = <2,<0,nil,nil>,nil>, we 
have MT = 0, noticing how an “exception” is raised as the node value 0 is 
encountered. 

In conclusion, the A may be regarded as a control operator similar to 
call/cc of Scheme and exceptions of ML, and the double negation embedding 
of classical logic into intuitionisitic logic corresponds to well-known CPS- 
translations of terms with control operators into pure, control-operator-free 
languages. 


8.8. Historical remarks 


Felleisen and his co-workers studied A-calculi with control operators in an 
untyped setting. Their aim was to provide a foundation of type-free func- 
tional programming langauges with control operators similarly to the way 
A-calculus may be regarded as a foundation of type-free pure functional 
programming languages. 

Felleisen devised a control calculus, an extension of the A-calculus, and 
carried out what could aptly be called Plotkin’s program (see [83]) for the 
study of the relation between calculi and programming languages. 

Griffin discovered in 1990, in an attempt to incorporate control operators 
into the world of typed A-calculi, that Felleisen’s C-operator could be typed 
by the classical double negation elimination rule [49]. Using this rule does, 
however, lead to certain difficulties because typing is not in general preserved 
under reduction (“Failure of Subject Reduction.”) This defect was repaired 
by Griffin via a so-called computational simulation. 

Later, Murthy overcame the same difficulties by changing the type sys- 
tem into a so-called pseudo-classical logic. Applying conservativity results 
of classical logics over corresponding minimal logics Murthy showed in [75] 
that for a certain class of classically provable formulas the Realizability In- 
terpretation remains sound. This was done using CPS-translations of control 
operator calculi into pure A-calculi. 

Since the seminal work of Griffin and Murthy, numerous systems have 
appeared that connect classical logic and control operators; indeed, the study 
of classical logic in connection with the Curry-Howard isomorphism now 
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constitutes a separate field. 


8.9. Exercises 
8.9.1. EXERCISE. Prove Proposition 8.1.3. 


8.9.2. EXERCISE. 


1. Show that Peirce’s law can be derived from the special case of Peirce’s 
law and ex-falso. 


2. Show that double negation elimination can be derived from the special 
case of Peirce’s law and ex-falso. 


3. Show that the special case of Peirce’s law and ex-falso can both be 
derived from double negation elimination. 


8.9.3. EXERCISE. Prove that T F ọ can be derived in the system of Defini- 
tion 8.1.2 iff T F y can be derived in the system of Remark 8.1.4. 


8.9.4. EXERCISE. Let p be some implicational formula such that If ọ in 
CPC(—), and consider the system Z which arises from CPC(—) by adding 
all instances (substituting implicational formulas for propositional variables) 
of y as axioms. Show that F L in Z. 


8.9.5. EXERCISE. prove Proposition 8.2.2. 
8.9.6. EXERCISE. Show that in CPC(—,V,/) one can derive F a V na. 
8.9.7. EXERCISE. The rule 

(Az:-=(y > W).M) N >a Az:7nw.M{e := Ay: p > Y . z (y N)} 


can only reduce A’s inside an application. The following aggressive variant 
does not wait for the application: 


(Ag:n(y > v).M) >a Aa:p . Aza. M{x := Ay: > Y . z (ya)} 


Corresponding to these two different rules, give reduction rules for the con- 
structs 7;(Az:7(y A Y).M) and Az:7(p A w).M. 
Can you give corresponding rules for disjunction? 


8.9.8. EXERCISE. Show that —ga on A,a-terms a la Curry is Church-Rosser, 
or show that —ga on A,-terms a la Curry is not Church-Rosser. 
Same question for +g, on terms à la Church. 


8.9.9. EXERCISE. Does the following hold? For any M € Ay, M E N iff 
M €NFga. 
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CHAPTER 9 


First-order logic 


In this chapter we extend our consideration to formulas with quantifiers and 
generalize the proof systems and interpretations seen in earlier chapters to 
the first-order case. 


9.1. Syntax of first-order logic 


The objects investigated by propositional logic are compound statements, 
built from some atomic statements (represented by propositional variables) 
by means of logical connectives. The goal is to understand relations be- 
tween compound statements depending on their structure, rather than on 
the actual “meaning” of the atoms occurring in these statements. But math- 
ematics always involves reasoning about individual objects, and statements 
about properties of objects can not always be adequately expressed in the 
propositional language. The famous syllogism is an example: 


All humans are mortal; 
Socrates is a human; 
Therefore Socrates is mortal. 


To express this reasoning in the language of formal logic, we need to quantify 
over individual objects (humans), and of course we need predicates (rela- 
tions) on individual objects. The logical systems involving these two features 
are known under the names “predicate logic”, “predicate calculus” , “quanti- 
fier calculus” or “first-order logic”. This section describes a variant of the 
first-order syntax. Such syntax is always defined with respect to a fixed 
first-order signature X}, which is typically assumed to be finite. Recall from 
Chapter 6 that a signature is a family of function, relation and constant 
symbols, each with a fixed arity. Also recall that algebraic terms over © are 
individual variables, constants and expressions of the form (ft1 ...tn), where 
f is an n-ary function symbol, and ¢1,... ,t, are algebraic terms over X. 
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9.1.1. DEFINITION. 


1. An atomic formula is an expression of the form (rt, ...tn), where r is 
an n-ary relation symbol, and t1,... ,tn are algebraic terms over X. 


2. The set ®y of first-order formulas over ®©, is the least set such that: 


e All atomic formulas and L are in ®y; 


e If p, Y E Py then (p > 4), (pV 4), (PAY) E Ps; 
e If y € ®y and z is an individual variable, then Vz y, Jx y € y. 


3. As usual, we abbreviate (p — L) as my and ((y — Y) A (w > ¢)) as 
(poy). 


4. A formula is open iff it contains no quantifiers. 


9.1.2. CONVENTION. The parentheses-avoiding conventions used for propo- 
sitional formulas apply as well to first-order formulas. However, there is no 
general consensus about how quantifiers should be written. One convention, 
which is common in logic, is that a quantifier is an operator of highest pri- 
ority, so that “Vz y — y” stands for “(Vz p) —> yY”. The other convention 
seems to have originated in type theory and is that the quantifier scope 
extends as much to the right as possible. In order to avoid confusion, we 
will sometimes use extra parentheses and sometimes we will use an explicit 
dot notation. Namely, we will write “Vz.p — w” for “Va(y — w)” and 
“Vry. > yp” instead of “(Vry) > y”. (Needless to say, authors sometimes 
forget about such conventions. The reader should be warned that each of 
the two authors has got used to a different style.) 


9.1.3. DEFINITION. 


1. If t is an algebraic term then FV (t) stands for the set of all variables 
occurring in t. 


2. The set FV (wy) of free variables of a formula ¢ is defined by induction: 


° FV (rti ...tn) = FV(ti) U... U FV (tn); 
© FV(p > 4) = FV (9V 4) = FV (p AY) = FV (4) U FV (4); 
e FV (Vay) = FV (Gz p) = FV(ẹ)-— {z}. 


3. A sentence, also called a closed formula, is a formula without free 
variables. 


9.1.4. DEFINITION. The definition of a substitution of a term for an individ- 
ual variable, denoted y[x := t], respects the quantifiers as variable-binding 
operators, and thus must involve variable renaming. Formally, 
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The simultaneous substitution, written pla, := t1,... , £n := tn], is the 
term 
a woes Te, gt 1 re | n,_ sn Te Mn 
y|x1 = $1] PASES [En:= Sn] [yi = Z| A lum, =Zm,| ae [yi = 27] po Yma := Zm, l> 
where z',... TAN are all variables in t;, the variables yi are all fresh and 


different, and s; = t;[z}:=yi] --- [eha = yia], for all i. 


9.1.5. CONVENTION. It is a common convention to write e.g., y(x, y, z) in- 
stead of vy, to stress that x,y,z may occur in y. In this case, the notation 
like y(t, s,u) is used as a shorthand for |x := t,y := s,z := ul]. We will 
also use this convention, but one should be aware that it is not a part of the 
syntax. 


It is not customary to introduce alpha-conversion on first-order formu- 
las. Typically, alpha-equivalent formulas are considered different, although 
they are equivalent with respect to all reasonable semantics, and one can 
be derived from another with all reasonable proof systems. However, for 
uniformity of our presentation, we prefer to allow for the alpha-conversion 
(defined in the obvious way) and identify alpha-convertible formulas from 
now on. 


9.2. Intuitive semantics 


The Brouwer-Heyting-Kolmogorov interpretation of propositional formulas 
(Chapter 2) extends to first-order logic as follows: 


e A construction of Vx p(x) is a method (function) transforming every 
object a into a construction of (a). 


e A construction of dx p(x) is a pair consisting of an object a and a 
construction of (a). 


Note that the BHK-interpretation should be taken with respect to some do- 
main of “objects”. These objects are syntactically represented by algebraic 
terms. 
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9.2.1. EXAMPLE. Consider the following formulas: 


1. Ad¢ y. = Vary; 


2. Way. > Irag; 
- (Y > Yz y(x)) > Yz(p — p(x)), where x g FV (4%); 
- (Y > Sa y(x)) > Jæ(Y > p(x)), where x g FV (4%); 


3 

4 

5. Vey > Y) > (Iz p. > Is Y); 

6. Ve(Ņ V y(x)) > Y V Yz g(x), where x ¢ FV (4); 
7. Yel > Y). > (Vey. > Yr Y); 

8. (Yz y(x). > Y) > Izr(y(x) > Y), where x € FV (4); 
9 


. Yz y(x). > p(t); 


10. =-Vz(y V =g); 
11. Y — Yx y, where x ¢ FV (4); 


12. Ax 


=—— 


y ply). > 9(z)) 


Although all these formulas are all classical first-order tautologies,! one will 
have difficulties finding BHK-interpretations for some of them. 


9.2.2. REMARK. It should be no surprise when we say that universal quan- 
tification is a generalization of conjunction. Indeed, the sentence “all cats 
have tails” is quite like an infinite conjunction of statements concerning each 
individual cat separately. In quite the same spirit one can say that existen- 
tial quantification is a generalized disjunction. This idea is reflected by the 
algebraic semantics, where we interpret quantifiers as (possibly infinite) joins 
and meets, see Definitions 9.4.3 and 9.4.4. 

But the BHK-interpretation as above hints for another correspondence: 
between universal quantification and implication, because in both cases we 
have a function as a construction. The analogy is so strong that in certain 
systems with quantifiers, implication is just syntactic sugar. We will see it 
in Chapters 10 and 13. 


9.3. Proof systems 


The three main approaches: natural deduction, sequent calculus and the 
Hilbert style extend to first-order logic by adding suitable rules and axioms 
to the rules and axiom schemes for propositional logic. The notation Fy, 
Fz, etc., is the obvious modification from the propositional case. 


"We assume that the reader is familiar with classical first-order logic. A suggested 
textbook is e.g. [70]. 
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Natural deduction 


We extend the system of natural deduction with the following rules to in- 
troduce and eliminate quantifiers: 


rey TEVay 
ODT (x g FV(L)) P mpi 
-nT F gla := t] as ap: T, pF y 
a re (3E) EY (x € FV(T,4%)) 


The reader should be warned that our rules are such because we have agreed 
on alpha-conversion of formulas. Otherwise, one has to modify rules (VI) 
and (JE) to work for any alpha-variant of the quantifier bindings. Similar 
modifications would have to be done on the other proof systems to follow. 


Sequent calculus 


Here are classical sequent calculus rules for quantifiers. Note the symmetry 
between the two quantifiers. 


T p ENE P A 
eE V 4 eg FV(T,A)) 
T,Veapr& TEVay,A 
_ T,pF E -TF gļz:= t], A 
ma e urra day ees 
T,drygr X TRary,A 


To obtain intuitionistic sequent calculus we restrict ourselves to single for- 
mulas at the right-hand sides (= consists of a single formula and A is always 
empty). 


T, ylz := t| F o Tro 
D Evega Te AN 
an DF -p T F gla := t] 
(aL) 22" eene a 


9.3.1. THEOREM (Cut elimination). For all p and T, if the sequent T F » 
has a proof then it has a cut-free proof. 


The following was probably first shown by Rasiowa and Sikorski using 
the topological space semantics, see [88]. 


9.3.2. COROLLARY (Existence property). If | 3x y then there exists a term t 
such that + y[ax := t]. 
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PROOF. The last rule in a cut-free proof of F dz y must be (SR). oO 


Note that if the signature consists of relation symbols only (and thus the 
only terms are variables) then F 4x y implies F Vz y! 


Hilbert-style proofs 


It is difficult to find two different authors who would give identical Hilbert- 
style proof systems.? Our choice is as follows. We take as axioms all the 
propositional axiom schemes, and in addition all formulas of the form: 


e Vro(z). > p(t); 


e y(t) > Az y(x); 


e Y — Yx, where x Z FV (4); 


Jz y. — yp, where x ¢ FV (4); 


e Vz(p > Y). > (Vay. > Va). 


As inference rules of our system we take modus ponens and the following 
generalization rule: 

P 

Vay 
The use of generalization requires some caution (corresponding to the side 
conditions in rules (VI) and (VR)). 


9.3.3. DEFINITION. A formal proof of a formula y from a set [ of assump- 
tions is a a finite sequence of formulas 1, Y2,... , Yn, such that Yn = y, 
and for alli =1,...,m, one of the following cases takes place: 


e y; is an axiom; 
e y; is an element of T; 


e there are j, l < i such that Y; = Ye — Yj (i.e., Yi is obtained from Yj, 
we using modus ponens); 


e there is j < i such that p; = Vz pj, for some x ¢ FV(L) (i.e., y is 
obtained from y; by generalization). 


?Unless they are co-authors, of course. 
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9.3.4. WARNING. In many textbooks, the above definition of a proof does 
not include the restriction on applicability of the generalization rule. This 
does not matter as long as T is a set of sentences (what is typically assumed). 
In general however, this gives a different relation FẸ, such that 


[ty iff T° fy yg, 


where I° is obtained from T by binding all free variables by universal quanti- 
fiers placed at the beginning of all formulas. For this relation, the deduction 
theorem (see below) would only hold for I consisting of sentences. 


9.3.5. LEMMA (Deduction Theorem). 
The conditions T,pFy Y andl Fy yp > w are equivalent. 


PROOF. Easy. o 


9.3.6. THEOREM. Natural deduction, sequent calculus, and the above Hilbert- 
style proof system are all equivalent, i.e., T Fy y andT Fy p andl Fy y 
are equivalent to each other for all T and y. 


PROOF. Boring. o 


Translations from classical logic 


Double negation translations from classical to intuitionistic logic can be ex- 
tended to the first-order case. We add the following clauses to the definition 
of the Kolmogorov translation of Chapter 8: 


e t(Va p) := =V t(p); 


Jz t(y). 


and we still have the following result: 


e t(ary):=7 


9.3.7. THEOREM. A formula ¢ is a classical theorem iff t(y) is an intuition- 
istic theorem. 


PROOF. Exercise 9.5.6 O 


Since classical provability reduces to intuitionistic provability, and classical 
first-order logic is undecidable, we obtain undecidability of intuitionistic 
first-order logic as a consequence. 


9.3.8. COROLLARY. First-order intuitionistic logic is undecidable. 


In fact, the undecidability result holds already for a very restricted frag- 
ment of first-order intuitionistic logic, with V and — as the only connectives 
and with no function symbols. In particular, there is no need for negation 
or falsity. 
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9.4. Semantics 


We begin with classical semantics. Assume that our signature X consists of 
the function symbols f1,... , fn, relation symbols r1,...,rm and constant 
symbols c1,... , Ch. 


9.4.1. DEFINITION. A structure or model for X is an algebraic system A = 
COs ih OEE Ak ga ec ROE cA, where the f/’s and r£’s are respec- 
tively operations and relations over A (of appropriate arities) and the cfs 
are distinguished elements of A. 


9.4.2. CONVENTION. 


e Typical notational conventions are to forget about the superscript 4 in 
e.g., f4, and to identify A and A. (Otherwise we may write A = |A|.) 


e We think of relations in A as of functions ranging over the set {0,1} 
rather than of sets of tuples. 


9.4.3. DEFINITION. 


1. Let t be a term with all free variables among 7, and let @ be a vector of 
elements of A of the same length as 7. We define the value t4(@) € A 
by induction: 

o (2i)A(@) = ai; 
© (ftr...tr)*(@) = fA @, ... ,t2(@)). 


2. Let y be a formula such that all free variables of y are among #, and 
let g be as before. We define the value y4(@) € {0,1}, as follows 


e 14(a) =0; 
° (rti...tn)A(@) = rA(t4@),... ,14(@); 
© (pV )A(@) = pA(@) UdA@); 
© (pA W)A@) = pA) NYA); 
a a (a); 


A(a) = inf{y(y, Z)A4(b, a) : b € A}; 
A(@) = sup{y(y, Z)A(b, a) : b € A}, 


where the operations U, N, =, inf and sup, and the constant 0 are in 
the two-element Boolean algebra of truth values. (Of course, we have 
a=>b=(1—a)Ub.) We write A,@ — (Zz) iff y4(a) = 1, and we 
write A = y(2) iff A, a H y(x), for all œ. We write T = ọ iff for all A 
and @ with A, & = y, for all y €T, we also have A, d H y. 
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The above definition can now be generalized so that values of formulas are 
not necessarily in {0,1}, but in the algebra P(X) of all subsets of a certain 
set X. Relations over A may now be seen as functions ranging over P(X) 
rather than {0,1}, i.e., the notion of a structure is more general. One can go 
further and postulate values of formulas in an arbitrary Boolean algebra B. 
This will work as well, provided B is a complete algebra, i.e., all infinite 
sup’s and inf’s do exist in B. (Otherwise, values of some quantified formulas 
could not be defined.) 

One can show that these generalizations do not change the class of clas- 
sically valid statements of the form T | y (Exercise 9.5.7). We do not 
investigate this further, since classical logic serves us as an illustration only. 


Algebraic semantics 


An obvious idea how to adopt the above approach to intuitionistic logic is 
to replace complete Boolean algebras by complete Heyting algebras. 


9.4.4. DEFINITION. 


1. An intuitionistic H-structure for © is a system 
A= (Ay fA or , A E cat rA efn. cA), 
where the f/’s and rÆ’s and c/s are as before, and the ræÆ’s are 


functions of appropriate arity from A to a complete Heyting algebra H. 


2. The values of terms and formulas are defined as in Definition 9.4.3, 
except that operations U, N, inf, sup and => are in H. 


3. The notation A, @ = y(Z) and AE (2) is as in Definition 9.4.3. 


4. The notation IT |} y should be understood as follows: “For all H 


=> 


and all H-structures A and vectors @, with A,@ = T, we also have 
A, wee: 


5. The symbol x is } restricted to any given class K of complete Heyt- 
ing algebras. 


An example of a complete Heyting algebra is the algebra of open sets of a 
topological space (in particular a metric space), where sup is set-theoretic LJ, 
and 

inf{A; : i € I} = Int((\{Ai: i € TP). 


9.4.5. THEOREM. 
The following conditions are equivalent for the intuitionistic first-order 
logic: 


1. TF gy, where “F” is either “Fy” or “Fy” or “FH”; 
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2: T 9; 


3. T Ex vy, where K is the class of (algebras of open sets of) all metric 
spaces. 


It seems to be still an open problem whether the class of all metric spaces 
can be replaced by a one-element class consisting only of R?. But it can 
be shown that there exists a single metric space of this property, see [88]. 
(Note however that R? can still be used for counterexamples.) 


Kripke semantics 


An alternative way of relaxing the definition of classical semantics is to keep 
the classical notion of a model, but think of models as of possible worlds. 


9.4.6. DEFINITION. A structure A = (A, fF) ne , ff rf... r4, cf... A 
is a substructure of B = (B, fP,...,f8,r8,... r8, c2, ... , cB) iff the follow- 
ing hold: 

e ACB; 


e rA C rB, for all 2; 
° fA C fË, for all 4; 
° cf = P, for all i. 


Thus, 6 extends the possible world A by enriching the domain of available 
objects and by adding more information about known objects. We write 
A C B to express that A is a substructure of B. 


9.4.7. DEFINITION. A Kripke model for first-order logic is a triple of the 
form C = (C, <, {Ae : c E€ C}), where C is a non-empty set, < is a partial 
order in C, and A,’s are structures such that 


if c < d then A, C Av. 


Let now y be a formula such that all free variables of y are among Z, and 
let g be a vector of elements of A, of the same length as 7. We define the 
relation |I} by induction as follows: 


e c, a |F rty...ty iff Ac, a H rti... tn (classically); 
ecal l; 


ecalkyvwyw iff clk yor c lF yp; 


ecalkKypAw iff cal yand c, lF y; 
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ecalkK yy iff c,alk y, forall such that c< c and d,a lF gy; 


> 


e ca lF Jyyly, zZ) iff c,b,alF p(y, T), for some b € Ac; 


e ca lF Yyyly, 7) iff ¢,b,alF (y, 7T), for all c’ such that c < c’ and 
all b € Ae. 


The symbol |} is now used in various contexts as usual, in particular F lk » 
means that c, |F y whenever c,a IF T. 


9.4.8. THEOREM. The conditions T IF p andT = ọ are equivalent. 


More about semantics can be found in [88, 106, 107, 108]. 


9.5. Exercises 


9.5.1. EXERCISE. Find constructions for formulas (1), (3), (5), (7), (9) and (11) 
of Example 9.2.1, and do not find constructions for the other formulas. 


9.5.2. EXERCISE. A first-order formula is in prenez normal form iff it begins 
with a sequence of quantifiers followed by an open formula. Consider a 
signature with no function symbols, and let y be an intuitionistic theorem 
in a prenex normal form. Show that there exists an open formula y’ obtained 
from y by removing quantifiers and by replacing some variables by constants, 
and such that + y’. Hint: Use the existence property (Corollary 9.3.2). 


9.5.3. EXERCISE (V.P. Orevkov). Apply Exercise 9.5.2 to show that the prenex 
fragment of intuitionistic first-order logic over function-free signatures is 
decidable. (In fact, this remains true even with function symbols in the 
signature, but fails for logics with equality, see [29]). 


9.5.4. EXERCISE. Prove that every first-order formula is classically equiv- 
alent to a formula in prenex normal form. Then prove that intuitionistic 
first-order logic does not have this property. 


9.5.5. EXERCISE. Show that the existence property (Corollary 9.3.2) does 
not hold for classical logic. Why does the proof break down in this case? 


9.5.6. EXERCISE. Prove Theorem 9.3.7. 


9.5.7. EXERCISE. Let X be an arbitrary set with more than one element. 
Show that the semantics of classical logic where values of formulas are taken 
in the family P(X) of all subsets of X is equivalent to the ordinary semantics. 
That is, the sets of tautologies are the same. 


9.5.8. EXERCISE. Verify that the odd-numbered formulas of Example 9.2.1 
are intuitionistically valid, while the even-numbered ones are not. 


154 Chapter 9. First-order logic 


9.5.9. EXERCISE. Show that the following classical first-order tautologies are 
not valid intuitionistically: 


© Ar(y(x) > Yr y(z)); 
e Ja(y(0) V (1) > v(x); 


e Vz ==p(z). > ==Vz p(x); 


e dry (2). > =r y(x). 


9.5.10. EXERCISE. A Kripke model C = (C, <, {Ae : c E€ C}) has constant 
domains iff all the A, are the same. Prove that the formula Vz(w V y(x)) © 
wVVa p(x), where x FV (4) (formula (6) of Example 9.2.1) is valid in all 
models with constant domains. 


9.5.11. EXERCISE. Prove that the formula =-V2x(y V 7y) (formula (10) of 
Example 9.2.1) is valid in all Kripke models with finite sets of states. 


CHAPTER 10 


Dependent types 


Dependent types can probably be considered as old as the whole idea of 
propositions-as-types. Explicitly, dependent types were perhaps first used 
in various systems aimed at constructing and verifying formal proofs. One of 
the first was the project AUTOMATH of de Bruijn, see [28]. Another such 
system that gained much attention is the Edinburgh Logical Framework (LF) 
of Harper, Honsell and Plotkin [51]. The expression “logical frameworks” 
is now used as a generic name for various similar calculi, see [59]. Last but 
not least, one should mention here Martin-L6f’s type theory [77]. For more 
references, see [108, 51, 8]. Our presentation of dependent types follows 
essentially that of [8]. 

From a programmer’s point of view, a dependent type is one that depends 
on an object value. For instance, one may need to introduce a type string(n) 
of all binary strings of length n.! This type depends on a choice of n : int. 
The operator string makes a type from an integer, and corresponds, under 
the Curry-Howard isomorphism, to a predicate over int. Such a predicate 
is called a type constructor, or simply constructor. Of course, we have to 
classify constructors according to their domains, and this leads to the notion 
of a kind: we say that our constructor string is of kind int = *, where x is the 
kind of all types. Of course, there is no reason to disallow binary predicates, 
and so on, and thus the family of kinds should include 71 => ---T => *. 

A definition of an object of type string(n) may happen to be uniform 
in n, i.e., we may have a generic procedure Onlyzeros that turns any n : int 
into a string of zeros of length n. The type of such a procedure should be 
written as (Vx:int) string(x). 

In general, a type of the form (Vx:7)o is a type of a function applicable 
to objects of type T and returning an object of type o[x := al], for each 
argument a: T. It is not difficult to see that this idea is more general than 
the idea of a function type. Indeed, if x is not free in g, then (Vxz:7T)o behaves 


‘Example from [74]. 
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exactly as tT — ø. Thus, in presence of dependent types there is no need to 
introduce — separately. 

The set-theoretic counterpart of a dependent type is the product. Recall 
that if {Ay}zer is an indexed family of sets (formally a function that assigns 
the set A; to any t € T)? then the product of this family is the set: 


[| 4: ={feE (U A)T : f(t) € A, for all t € T}. 


teT teT 


For f € [ [ier At, the value of f(t) is in a set A;, perhaps different for each 
argument, rather than in a single co-domain A. If all A; are equal to a fixed 
set A, we obtain the equality 


[[4: = 4": 


teT 


corresponding to our previous observation about — versus V. 

The logical counterpart of this should now be as follows: the implication 
is a special case of universal quantification. And that is correct, because we 
have already agreed to identify objects of type 7 with proofs of r. We only 
have to agree that this way of thinking applies to individual objects as well, 
so that, for instance, an integer can be seen as a proof of int. 


10.1. System AP 


We will now define the Church-style system AP of dependent types. We 
begin with a calculus without existantial quantification, as in [8]. Unfortu- 
nately, even without existantial quantifiers, the language of AP is a broad 
extension of the language of simply-typed lambda-calculus. We have three 
sorts of expressions: object expressions (ranged over by M,N, etc.), con- 
structors (ranged over by 7, y, etc.) and kinds (ranged over by k, kK’, etc.). 
There are object and constructor variables (ranged over by x, y, ... and 
a,3,..., respectively), and one kind constant *. A type is treated as a 
special case of a constructor, so we do not need extra syntax for types. 

Contexts can no longer be arbitrary sets of assumptions. This is because 
in order to declare a variable of type e.g., ax, one has to know before that 
the application is legal, i.e., that the type of x fits the kind of a. Thus, 
contexts in AP are defined as sequences of assumptions. In addition, not 
every sequence of declarations can be regarded as a valid context, and being 
valid or not depends on derivability of certain judgements. 

For similar reasons, being a constructor or a kind, also depends on deriv- 
able judgements. Well-formed types, kinds and contexts are thus formally 
defined by the rules of our system. 


?That is why we do not use here the set notation {A+ : t € T}. 
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Unfortunately, we cannot stick to = as the only way to build kinds, and 
we have to introduce a more general product operator also at the level of 
kinds. To understand why, see Example 10.2.3(2). 


10.1.1. DEFINITION. 


1. Raw expressions (raw contexts I, raw kinds «K, raw constructors ¢ and 
raw lambda-terms M) are defined by the following grammar: 


P= {}(T,(e: 4) [T,(a: 8) 
K ::= x | (IIx : d)K; 

b= a | (vad)¢ | ($M); 

M ::= x | (MM) | (Az:¢.M). 


2. Beta reduction on raw terms is defined as follows: 


e (Ax:T.M)N >s M[N := zq]; 

e If T >g7' then Az:T.M > Ax:T'.M; 

e If M —, M' then àz:T.M —>g àz:T.M' and NM —, NM' and 
MN >s M'N; 

e If T 4,7’ then (Ilr: T)k 3g (Uz: 7’); 

e If k >, K' then (IIx: 7)K >g (Ilx : T)K’; 

e If T —g T then (Yx:T)o 4 (Yx:T')o; 

e Ifo >, o’ then (Yz:T)o > (Va:7)o"; 

o Ify—gy' then pM >g Y'M; 

e If M >, M' then yM >g pM". 


3. If (x : T) or (a : k) is in T then we write r(x) = 7 or Tr(a) = k, 
respectively. We also write Dom(T) for the set of all constructors and 
object variables declared in T. 


4. We skip the obvious definition of free variables. Of course, there are 
three binding operators now: lambda-abstraction, quantification and 
the product of kinds. And we also omit the definition of substitution. 


5. We use arrows as abbreviations: if x is not free in « then we write 
T = k instead of (IIx : T). And if x is not free in o then (Vz:T)ø is 
abbreviated by our good old implication T > ø. 


10.1.2. REMARK. In order to spare the reader some additional noise, we 
choose a non-standard presentation of AP, namely we do not allow lambda 
abstractions in constructors. Thus, every constructor must be of the form 
(Va:71) +++ (Y£:Tn)a Mı ... Mn. This restriction is not essential as long as our 
primary interest is in types. Indeed, a dependent type in normal form always 
obeys this pattern, and a term substitution may never create a constructor 
redex. 
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We will have three different sorts of judgements in our system: 


e kind formation judgements of the form “CF k : 0”; 


e kinding judgements of the form ‘T F gy: KR”; 


e typing judgements of the form “TFA M: 7”. 


” 


The meaning of “kt : is just that «K is a well-formed kind, and 
not a part of the language. 


10.2. Rules of AP 


Kind formation rules: 


Te: TKR: 


T F (Ilz:T)k : 


bx: 


Kinding rules: 


TERK: 


Ta:Kkra:k 


(a ¢ Dom(T)) 


Thee (ies Re es T,z:THFo:x 
TFM : w[x:= M] T F (Vz:T)o : * 


Typing rules: 
IPT 


EET FEET ee Pony) 


Tee War jo FM er Torr Mie 
rE- NM :olz := M] T F Az:T.M : (Yz:T)o 


itself is 


Note that there is no restriction “x ¢ FV(T)” attached to the V-introduction 
rule. This restriction is unnecessary because otherwise I’, x : 7 would not be 


a valid context, in which case the premise could not be derived. 


Weakening rules: 


There are six weakening rules, but all obey the same pattern: an additional 
assumption does not hurt, as long as it is well-formed. We need explicit 
wekening (rather than relaxed axioms) because of the sequential structure 


of contexts we must respect. 


TrTHr:x TEK: TKR: Th kK’: 


T,2:TKK: Eater k: 


(x g Dom(T)) (a ¢ Dom(T)) 
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Thr: Tho: TERK: Thko:k’ 
TI ¥** (eg Dom(r)) ——* £°* (a g Dom(L)) 
eer Peek Lover pik 
Ter:* TEM:0o TK: TEM: 
x g Dom(T a g Dom(T 
Pant MO He 1) Tr,a:kF F M:0 (R D 


Conversion rules 


These rules are necessary because of the terms occurring in types which do 
not have to be in normal forms. 


Pepi. Kao K ThKM:o0 o=go' 
Try: ek’ TtM:o 


10.2.1. REMARK. Note that type-checking in AP is not a trivial task, even 
if our language is Church-style. This is because the conversion rules. A 
verification whether two types or kinds are equal may be as difficult as 
checking equality of simply-typed lambda terms, and this decision problem 
is non-elementary (Theorem 6.7.1). 


10.2.2. DEFINITION. 
IfT 7: * then we say that 7 is a type in the context P. 


10.2.3. EXAMPLE. 


1. The lambda term Ay:(Vxz:0.ax — Bx).Az:(Vx:0.axr).Ax:0.yx(zx) has 
type (Vx:0.ar —> Bx) > (Vx:0.ax) > Yz:0.6x in the context consisting 
of declarations a:0 => * and 8 : 0 > «x. 


2. Here is an example of a kind that cannot be expressed only with =>: 


a: 0 > x F (Ily:0)(ay => *) : 


If we now declare a variable ọ to be of this kind, we can consider types 
of the form yyx, where x is of type ay. 


10.3. Properties of AP 


System AP has the Church-Rosser and strong normalization properties. 
These facts follow from properties of simply typed terms, thanks to an 
embedding M +> M°, described in [51]. Certain variants of this embed- 
ding (esp. the “forgetting map” M ++ M, which erases all dependencies) 
were also discovered by V. Breazu-Tannen and Ch. Paulin, but apparently 
R.O. Gandy was the first to use this approach (see [108, p. 565]). 
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10.3.1. DEFINITION. We define the dependency-erasure map on construc- 
tors: 


We write I for the contexts obtained by applying the above operation to all 
right-hand sides of declarations in I of the form (x : T), and removing other 
declarations. 


10.3.2. DEFINITION. The translations M+ M° and T |> 7° are defined 
for both types and terms of AP. Both terms and types are translated into 
terms. Below, 0 stands for a fixed type variable. Abusing the formalism a 
little, we assume that we can use as many fresh term variables as we want. 


(aMı ... Mn)? = 2M? ... Mẹ, where za is a fresh variable; 


(Va:T)o)® = x-T°(Au:T.o°), where x; is a fresh variable; 


( 
(Au:7.M)® = (Ay:0An:T.M*)r°, where y is a fresh variable. 


10.3.3. LEMMA. 
1. If TE 7: then Ptr: 0, for some extension I’ of T. 


2. FTA M:7 then PHM’: F, for some extension I” of T. 


3. If TF M:7 and M —g Mı then M? —¢ M? in at least one step. 


PROOF. Exercise 10.7.2. oO 


10.3.4. COROLLARY (Strong normalization). 
The system AP has the strong normalization property. 


Proor. By part (3) of Lemma 10.3.3, an infinite reduction starting from M 
would be translated to an infinite reduction in the simply-typed lambda 
calculus. oO 


10.3.5. COROLLARY. The system AP has the Church-Rosser property. 


PROOF. Exercise 10.7.5. O 
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10.4. Dependent types a la Curry 


10.4.1. DEFINITION. We define a type-erasure mapping |-| from terms of AP 
to pure lambda terms, as usual: 


e |z| = z; 
e |Ax:T.M| = Azx.|M|; 
e |MN] = |MIINI. 


For a a pure lambda term N, we write T Fp N : 7 iff N = |M], for some 
Church-style term M with + M : rt. We say that a pure lambda term N 
is typable iff T Fp N : 7 holds for some I, rT. 


An alternative to the above definition is to define a type assignment 
system for pure lambda-terms, corresponding to AP. Note that in this case 
we must deal with different notion of a type, since types must depend on 
pure lambda-terms rather than on Church-style terms. It follows that the 
type-erasure mapping must be extended to types and kinds. Fortunately, 
the notion of a typable term is the same with this approach as with our 
simple definition, see [5]. 


10.4.2. PROPOSITION. The Curry-style variant of AP has the subject-reduction 
property, that is if T Fp N:7 and N —>g N' then alsor Fp N':r. 


PROOF. Boring. See [5]. E 


Let us come back to the dependency-erasure map. We extend it to terms 
as follows: 


10.4.3. DEFINITION. 
TS: 
MN=MN; 
Az:T.M = d\2:7.M; 
We have the following result: 


10.4.4. LEMMA. If [+ M:7 then TH M:F (in X>). 


PROOF. Exercise 10.7.3. O 


10.4.5. PROPOSITION. A term is typable in AP iff it is simply-typable. In 
particular, the type reconstruction problem for AP is decidable in polynomial 
time. 
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PROOF. Suppose that T R M : 7 in AP. By Lemma 10.4.4, we have 
[+ M :7, in the simply typed lambda calculus. But it is easy to see that 
|M| = |M]. 

We have just shown that all pure terms typable in AP are typable in 
simple types. The converse is obvious, and thus type reconstruction in AP 


is the same as in simple types. O 
Here comes the surprise: it is not at all that easy with type checking! 


10.4.6. THEOREM (G. Dowek [31]). Type checking in the Curry-style ver- 
sion of AP is undecidable. 


No PROOF. We regret that we do not have enough time to present this nice 
proof. But we recommend reading the original paper [31]. oO 


10.5. Existential quantification 


This section is a diggression. The system AP, as most other typed lambda- 
calculi, is normally studied with Y and — as the only basic connectives. Of 
course, an extension of this system with V, A and L can be defined in much 
the same way as for the simply-typed lambda calculus. It remains to see 
what is the lambda calculus counterpart of existential quantification. The 
intuition suggests that (3x:T) y(x) should be understood as a disjoint union 
or coproduct of types y(a), for all objects a of type 7. That is, objects of 
type (Ax:T) y(x) are pairs consisting of an object a of type T and a proof M 
of y(a). This may be syntactically written as: pack M,a to (Sz:7) y(x). 

An elimination operator for type (42:7) y(x) takes such a pair and uses 
it whenever an object of type y(x) can be used with an unspecified x. This 
leads to the following deduction rules: 


Pe Mogec=N)| PRN sr 
[+ pack M,N to (Sa:7) y: (Az:7) p 


(Al) 


PRM: Ger) @ Teeter pF Nae 
[TF let z:ybeM: (Ar:7)pin N: yp 


(AE) (x g FV(T, y)) 


Note that although y in (SE) cannot contain x free, this restriction does 
not extend to the proof N. The variable « may thus be free in N, but it 
should be considered bound in the let expression. 

The reduction rule for sum types is as follows: 


let z : y be (pack M,N to (dz:7) y) in Q — Q[z := N][z := M] 


Everything is fine with this rule, as long as we do not get seduced by the 
temptation of making a Curry-style calculus with existential quantifiers. 
Look, how beautiful rules we may have: 
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PeM sgl: N] TEN:?T 
TEM :(3z:7)p 


(Al) 


PEM Geir) e Tyee FN: 4% 
rE- N[z:=M]|: 4 


—— 
L 


JE) (x g FVT, 4%)) 


These rules are based on the idea of existential polymorphism: a term of 
an existential type is like an object with some data being abstracted or 
encapsulated or “private”, and not available for external manipulations. It 
seems very appealing that this sort of abstraction might be done with only 
implicit typing discipline. 

There are however some annoying little difficulties when one attempts 
to prove the subject reduction property for a type inference system Ha with 
rules as above. Some of these difficulties can be eliminated by improving 
the rules, but some cannot. The following example is based on an idea used 
in [6] for union types (which cause similar problems). 


10.5.1. EXAMPLE. Consider a context I with the following declarations: 


O:*, œ&:ix, Bix, o:0=>x*, «:0, 
X:or—>oxr—>a, Y:B—-(Ar:0)or, Z:$. 


Then I Ha X(IY Z) (IY Z) : a, but IT Va X(IY Z(Y Z) : a. 


10.6. Correspondence with first-order logic 


The system AP of dependent types is much stronger than is needed to provide 
a term assignment for first-order intuitionistic logic. In fact, first-order logic 
corresponds to a fairly weak fragment of AP. This fragment is obtained by 
restricting the syntax? so that each context must satisfy the following: 


e There is only one type variable 0 (which should be regarded as a type 
constant), representing the type of individuals; 


e All kinds are of the form 0=>--->0=> x; 


e There is a finite number of distinguished constructor variables, repre- 
senting relation symbols in the signature (they must be of appropriate 
kinds, depending on arity); 


e Function symbols in the signature are represented by distinguished 
object variables of types 0 — --- — 0 — 0, depending on arity; 


e Constant symbols are represented by distinguished object variables of 
type 0; 


3 Of course one has to either add 3 to XP, as in the previous section, or to consider only 
universal quantification in formulas. 
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e Other declarations in the context may only be of the form (x : 0), and 
correspond to individual variables. 


Clearly, algebraic terms are represented now by lambda terms of type 0 
in normal form. Formulas are represented by types. Because of strong 
normalization, we can restrict attention to formulas containing only terms 
in normal form. It follows that an inhabited formula is a theorem and 
conversely. The reader is invited to formally define the syntax of the first- 
order fragment (Exercise 10.7.9). 

In summary, we have the following pairs of corresponding items: 


formulas ~ types 
proofs ~ terms 
domain of individuals ~ type constant 0 
algebraic terms ~ terms of type 0 
relations ~ constructors of kind 
0=>0>5-:-50> 
atomic formula r(t),... , tn) ~ dependent type rt; ...ty :* 


product type 
abstraction Ax : 0.M? 
application MY™0" N° 


universal formula 
proof by generalization 
proof by modus ponens 


2 2 2 


10.6.1. EXAMPLE. Consider the Hilbert-style axioms of Section 9.3 Each of 
them corresponds to a type in AP, extended by existential quantification as 
in Section 10.5. These types are inhabited as follows. (We write types as 
upper indices to improve readability.) 


© AY W@0)9@) Yt : (Vx:0) p(x). > v(t); 


e \X%() pack X,t to (Jx:0)y(x) : y(t) > (Ax:0)y(z); 
© AY ALY :  — (Vx : 0) yY, where x ¢ FV (1); 


e AY GY Jet 2: be Y:(4xr:0)y in z : (Ax:0)y. > Y, 
where x ¢ FV(w); 


e AX VEO l>) \y G0)? Jet 2? be Y:(Sx:0)y in pack Xxz, x to (Ax:0)¢ : 
(Vx:0)(y > Y). > ((Ax:0)y. —> (Ax:0))); 
e AX WHO (>) yy WH0)¥ 29 X2(Yz) : (Vr:0)(y > Y). > ((V2:0)y. > 
(Vx:0)W). 
Out of the above six examples three do not use existential quantification. 


If we apply the dependency-erasing translation M +> M to the third and 
sixth of the above terms, we obtain the typed combinators 


eK:~—>0—> y and 
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eS:(0-@G > wp) >(0- 9) -0 >. 


This may be a suprise on the first look that we obtain something so much 
familiar. But it is fully justified by the fact that universal quantification is 
a generalization of implication. 

The first example is a little less spectacular, as it erases to \YO°".Yt : 
(0 > P) > Y (parameterized by t: 0). 


The above embedding of first-order logic into AP can easily be generalized 
to various extensions. For instance, many-sorted logic is handled just by 
allowing more than one atomic type. Here are some examples of other 
features that are not present in first-order logic: 


e There are sorts (types) for many domains for individuals, and also for 
functions on the individuals; 


e There is a function abstraction mechanism (we deal with lambda-terms 
rather than algebraic terms); 


e Quantification over functions is permitted; a quantifier ranges over 
arbitrary expressions of a given sort; 


e Proofs are terms, so that properties of proofs can be expressed by 
formulas. 


The presence of quantification over objects of all finite types means that 
AP can express many higher-order languages (see [51]). We would how- 
ever prefer not to use the expression “higher-order logic” here, as there is 
no quantification over propositions. A more adequate statement about AP 
is that it provides a many-sorted first-order representation of higher-order 
logic. 

Another issue is expressibility of first-order theories in AP. You can find 
more about this in [8, p. 202]. 

As we have already observed, first-order intuitionistic logic is undecid- 
able. Thus type inhabitation in the corresponding fragment of AP must be 
also undecidable. But AP can be shown conservative over this fragment, and 
it follows that type inhabitation for the whole system is also undecidable. 
Another direct and simple proof can be found in [13]. 


10.6.2. THEOREM. Type inhabitation in AP is undecidable. oO 


10.7. Exercises 


10.7.1. EXERCISE. Let string(n) be the type of binary strings of length n. 
Every such string w determines a record type with integer and boolean 
fields corresponding to the digits in w. For example, for 01101 we take 
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int A bool A bool A int A bool. Define an appropriate context I declaring 
variables string and record so that record(n)(w) is a well-formed type, for 
n: int and w: string(n). 


10.7.2. EXERCISE. Prove Lemma 10.3.3. (First extend the translation to 
kinds and define I’. A substitution lemma will also be necessary.) 


10.7.3. EXERCISE. Prove Lemma 10.4.4. Also prove that TFH} M : 7 and 
M —, M' implies M >g M or M = M". 


10.7.4. EXERCISE. Consider the following attempt to prove strong normal- 
ization for AP: 


Assume first that a term M is such that no type occurring in M contains a lambda 
term. In this case an infinite reduction starting from M would be translated, 
by Lemma 10.4.4, to an infinite reduction in the simply-typed lambda calculus. 
The general case follows from the following induction step: If all subterms of M 
(including all terms occurring in types in M) are strongly normalizing then M 
is strongly normalizing. To prove the induction step, we observe that an infinite 
reduction starting from M translates to a sequence of pure terms N;, with N; = Nj, 
for all i,j > %. Thus our infinite reduction must, from some point on, consist 
exclusively of reduction steps performed exclusively within types. But all terms 
occurring in types are obtained from subterms of the original term M and thus 
must strongly normalize by the induction hypothesis. 


Find the bug in this proof. Can you fix it?4 


10.7.5. EXERCISE. Prove the Church-Rosser property for AP (Corollary 10.3.5). 
Warning: do first Exercise 10.7.6. Hint: Apply Newman’s Lemma. 


10.7.6. EXERCISE. Show an example of AP terms M and M ’ of the same 
type such that M = M, but M #8 M’. 


10.7.7. EXERCISE. The proof technique that fails for Church-style AP (Exer- 
cise 10.7.4) works for the Curry-style terms. Prove strong normalization for 
Curry-style AP with help of the dependency-erasing translation M > M. 


10.7.8. EXERCISE. Verify the correctness of Example 10.5.1. 


10.7.9. EXERCISE. Define formally the fragment of AP corresponding to first- 
order logic over a fixed signature. 


10.7.10. EXERCISE. Consider the odd-numbered formulas of Example 9.2.1, 
as types in an appropriate extension of AP. Write lambda-terms inhabiting 
these types. (If necessary use operators related to conjunction, disjunction, 
and the existential quantifier.) 


4We do not know how. 
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10.7.11. EXERCISE. We know that types of K and S are sufficient to ax- 
iomatize the arrow-only fragment of propositional intuitionistic logic. These 
types correspond to the third and sixth axiom of Section 9.3 (see Exam- 
ple 10.6.1). One can thus conjecture that the first axiom Vz y(x). > y(t), 
which becomes (0 — p) — @ after erasing dependencies, can be eliminated 
from the axiom system. Show that this conjecture is wrong: our formula 
cannot be derived from the other two axiom schemes. 
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CHAPTER 11 


First-order arithmetic and Godel’s T 


Arithmetic is the core of almost all of mathematics. And expressing and 
proving properties of integers always was one of the primary goals of math- 
ematical logic. In this chapter, we will trace the Curry-Howard correspon- 
dence back to the 40’s and 50’s, to discover it in some fundamental works of 
Kleene and Gödel. Both these works aimed at proving consistency of Peano 
Arithmetic. For this purpose they give some fundamental insights on the 
constructive contents of arithmetical proofs. 


11.1. The language of arithmetic 


The signature (cf. Definition 6.6) of first-order arithmetic consists of two 
binary function symbols + and -, two constant symbols 0 and 1 and the sym- 
bol = for equality.! The standard model of arithmetic is the set of integers 
N with the ordinary understanding of these symbols, i.e., the structure: 


N = (N,+,-,0,1,=). 


Note that all elements of N can be given names in the language of arithmetic. 
Let n denote the term 1+1+---+1, with exactly n copies of 1 (assuming 
that 0 is 0). 

By Th(A) we denote the set of all first-order sentences that are classically 
true in A (i.e., the set of all sentences y such that A = y, in the sense of 
Section 9.4). The following classical result shows the limitation of first-order 
logic: 


11.1.1. THEOREM. There exists a nonstandard model of arithmetic, i.e., a 
structure M = (M, $, 8,0,1, =), such that Th(M) = Th(NV), but M and 
N are not isomorphic. 


1 Another typical choice is to take a unary function symbol s for the successor function, 
instead of 1. 
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The above fact is a consequence of compactness theorem, see [71]. 

However, the definitional strength of first-order formulas over the stan- 
dard model is quite nontrivial. Let us say that a k-ary relation r over N 
is arithmetical iff there exists a formula y(Z) with k free variables 7, such 
that, for every ñ € NF: 


r(7) holds iff NE (ñ). 


A function is arithmetical iff it is arithmetical as a relation. We have the 
following theorem of Gödel: 


11.1.2. THEOREM. All partial recursive functions (in particular all recursive 
functions) are arithmetical. 


In fact, partial recursive functions and relations are just the very beginning 
of the “arithmetical hierarchy”. The above theorem implies in paricular 
that Th(V) must be undecidable. Otherwise, membership in every r.e. set 
would be also decidable. 


11.2. Peano Arithmetic 


Before Gödel, people thought that it could be possible to axiomatize Th(V), 
i.e., to give a simple set of axioms A such that all sentences of Th(V) 
would be consequences of A. Peano Arithmetic, abbreviated PA, is such an 
attempt. The axioms of PA are the following formulas: 


e YrYy (z =y > y= 2); 

e VeVy (y(x) > z = y > ọyl(y)); 
e Vx-(2 +1 =0); 

e VaVy(a+1l=y+1l—-2r=y); 


e Vx(x+0=2); 


VavVy (x + (y +1) = (x +y) +1); 


e VrVy (x - (y +1) = (x-y) +2); 


e Vz (p(x) > p(x + 1)). > (0) > Yz p(x)). 
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The third and the last items are actually axiom schemes, not single axioms. 
Although the set of axioms is thus infinite, it is still recursive, and thus the 
set of theorems (derivable sentences) of PA is r.e. The last axiom scheme is 
called the induction scheme. 

A theory T (a set of sentences) is complete iff for all sentences ~ of 
the first-order language of T, either T F w or T F aw. Gédel’s famous 
incompleteness theorem asserts that PA is not a complete theory. This 
statement is equivalent to PA 4 Th(N), because every Th(A) is complete. 

The importance of Gédel’s theorem is that it holds also for all extensions 
of PA, as long as they are effectively axiomatizable. (A consequence of this 
is of course that Th(V) is not r.e.) 


11.2.1. THEOREM (Gédel incompleteness). There is a sentence Z such that 
neither PAF Z nor PAF =Z. 


PROOF. The proof of the theorem is so beautiful that we cannot resist the 
temptation to sketch here the main idea, which is to express the “liar para- 
dox”? in the language of arithmetic. This cannot be done in full, as it would 
imply inconsistency of arithmetic, but a weaker property will do. Gdédel’s 
sentence Z expresses the property “Z has no proof in PA”. More formally, 
we have: 


NEZ iff PAZ. 


Now if PAF Z then N FE Z, because M is a model of PA, and thus PA Y Z. 
On the other hand, if PA F ~Z then N H =Z, but also N = Z, by the 
property of Z. Thus Z can be neither proved nor disproved within PA. 

The construction of Z is based on the idea of Gödel numbering. Each 
expression in the language gets a number, and we can write formulas express- 
ing properties of expressions by referring to their numbers. In particular, 
one can write a formula T(x, y), such that: 


NET(n,m) if PAF gp(m) 


whenever n is a number of a formula yn(x) with one free variable x. The 
formula ~T (x, x) must also have a number, say ~T (x, x) = p(x). Thus 


NF ¢x(n) iff PAY gn(n). 
The formula Z that says “I have no proof!” can now be defined as p(k): 


NF px(k) iff PAY px(k). 


?The sentence: “This sentence is false” cannot be true and cannot be false. 
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It was a popular opinion among mathematicians that Gödel’s theorem is of 
little practical importance. Indeed, the formula Z is based on an artifficial 
diagonalization, and everything one finds in number theory textbooks could 
be formalized in PA. It is commonly assumed that the first “natural” mathe- 
matical problem independent from PA, was shown by Paris and Harrington, 
see [11]. This problem concerns finite combinatorics and may indeed be 
considered natural. But it is not a purely arithmetical problem, i.e., it has 
to be coded into arithmetic. In addition, it was actually invented for the 
purpose of being independent, rather than suggested by actual mathemat- 
ical research. We will see later a strong normalization theorem (and these 
definitely belong to the mathematical practice) independent from PA. This 
theorem was obtained already by Gödel, and thus is much older than the 
Paris and Harrington example. 

With the Gödel numbers technique, one can express consistency of PA. 
Indeed, let T(x) be a formula such that: 


NET(n) if PAF gn, 


whenever n is a number of a sentence Yn. Let k be the number of the 
sentence “0 = 1” and let Con be the formula “~T (k)”. Then Con expresses 
consistency of PA: 


N H Con iff PA is consistent. 


The following theorem was also obtained by Gödel, by a refinement of tech- 
niques used for the proof of Theorem 11.2.1. 


11.2.2. THEOREM (Non-provability of consistency). If PA is consistent then 
PA 7 Con. 


The conclusion is that to prove consistency of arithmetic, one must neces- 
sarily use tools from outside the arithmetic. 


11.3. Representable and provably recursive functions 


We now consider two properties of functions that are stronger than being 
arithmetical. We not only want our functions to be definable over the stan- 
dard model, but we want to prove in PA (or some other theory) that the 
appropriate formula actually defines a function. 

In the definition below, the symbol J! should be read as “there exists ex- 
actly one”. Formally, 3!x y(x) is an abbreviation for “Jx y(x). AVy (y(y) > 
c=)". 


11.3.1. DEFINITION. We say that a k-ary total function f over N is repre- 
sentable in PA iff there exists a formula y(#,y), with k + 1 free variables 
gZ, y, such that: 
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1) f(n) = m implies PAF y(ñ, m), for all ñ, m; 


2) PAF Jlyg(ñ, y), for all 7 € NF. 


A function is strongly representable in PA, if (1) holds and 


3) PA F V# aly p(Z, y). 


Each representable function is in fact strongly representable (Exercise 11.8.3) 
but proving that (2) implies (3) is a brutal application of tertium non datur. 
Of course, each representable function is arithmetical. The converse is not 
true, but we have the following stronger version of Theorem 11.1.2: 


11.3.2. THEOREM (Gödel). A function is representable in PA if and only if 
it is recursive. 


The above theorem implies that the totality of every recursive function can 
actually be proven in PA. However, the excluded middle trick used in Exer- 
cise 11.8.3 suggests that such proofs are not necessarily constructive. Proofs 
required by part (2) of Definition 11.3.1 are constructive, but non-uniform. 
What we want, is a constructive and uniform proof of termination for all 
arguments, such that we are able to actually compute the value m of f(7) 
from this proof. We should understand however that for this reason we 
should be concerned with particular algorithms rather than extensionally 
understood functions. This calls for a finer notion of provable totality. 

Recall that, by Kleene’s normal form theorem, every partial recursive 
function f can be written as 


f(a) = m2(uy-t (7, y) = 0), 


where 72 is a projection (second inverse to the pairing function) and ty is 
primitive recursive. The function ty describes a particular algorithm com- 
puting f. Termination of this particular algorithm can be expressed by a 
formula of the form 


Ve Ay (t;(Ē,y) = 0). 


Fortunately, primitive recursive functions do not create any of the above 
mentioned difficulties. That is, proofs of totality for primitive recursive 
functions are completely effective. In addition, every primitive recursive 
function can be uniquely defined by means of equational axioms. Thus, we 
can actually extend the language of PA by names and defining equations for 
“as many primitive recursive functions as we wish”? without any unwanted 
side-effects (i.e., this extension of PA is conservative.) It follows that as- 
suming the above formula to be literally a formula of PA is as harmless as 
it is convenient. 


3A quotation from [26]. 
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11.3.3. DEFINITION. A recursive function f is said to be provably total (or 
provably recursive) in PA iff 


PA F Vay (t/(Z,y) = 0). 


It is customary to talk about provably recursive functions, but what we 
actually deal with is the notion of a provably recursive algorithm. A function 
should be regarded provably total if one of its algorithms is provably total. 

The class of functions provably total in PA is very large and includes 
most of commonly considered functions, and much more, up to unbelievable 
complexity. But there are recursive functions that are not provably total 
in PA. 


11.4. Heyting Arithmetic 


The search for a constructive meaning of classical proof of totality of a recur- 
sive function, leads of course to the notion of intuitionistic arithmetic. By 
Heyting Arithmetic (HA), we mean a formal theory based on the following 
axioms and rules: 


e All axioms and rules of first-order intuitionistic logic; 
e All axioms of Peano Arithmetic; 
e Defining equations for all primitive recursive functions. 


This means that HA is a theory in the language of arithmetic, extended by 
new function symbols for all primitive recursive functions. This extension is 
not essential, because of conservativity, but is technically very useful. 

Here are some interesting properties of HA. (More can be found in [107] 
and [26].) 


11.4.1. THEOREM. 


1. HAF Yz Yy (z =yV-A(¢ = y)). 


2. If HA + Ary(x) for a closed formula 3x p(x) then HA F y(k), for 
some k EN. 


3. HAF (y Vy) 3z ((x =0 > p) A (A(a@ = 0) > Y)), for all p, 4. 
4. IfHAF pV y, for closed y and w, then either HA F y or HAF y. 


5. If HA F Vz (p(x) V ay(x2)) and HA F 7732 y(x) then HA F Sz y(x). 
(Markov’s Principle) 
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PROOF. 
1) Exercise 11.8.6. 
2) See [26] for a semantical proof using Kripke models. 


4) Follows from parts 2 and 3. 


) 
) 
3) Follows from part 2. 
) 
5) 


From HA + 7742 y(x) it follows that PA H Ja y(x), and thus M = 
p(k), for some k. But we have HA F ọ(k) V ~ọ(k) and thus, by (4), 
either y(k) or ay(k) is a theorem of HA. In each case we conclude 
that HA F Jz y(x). (But note that this proof is classical.) 


oO 


11.4.2. THEOREM (Kreisel (1958)). A recursive function is provably total in 
Peano Arithmetic iff it is provably total in Heyting Arithmetic. 


PROOF. The right-to-left part is immediate. We prove the other part. 
Without loss of generality, we consider the case of a unary function. Let 
PA F Va dy (t(x, y) = 0). Thus also PA F Jy (ts(x, y) = 0). One can show 
that the Kolmogorov translation (see Chapter 8 and 9) works for arithmetic 
(see e.g. [107]), so that we obtain HA F ~~3y (ts(x, y) = 0). From Theo- 
rem 11.4.1(1), we have 


HA F YrYy (t¢(2,y) = 0 V ~t, y) = 0). 


We apply Markov’s Principle (Theorem 11.4.1(5)) to obtain the desired re- 
sult. oO 


There is also a direct syntactic proof due to Friedman, which does not 
require the whole power of Markov’s Principle and carries over to second- 
order arithmetic. See Exercise 11.8.8. 

The proof of Kreisel’s theorem works as well for any formula of the form 
Va dy R(x, y), where R is a primitive recursive predicate. For instance, R 
may be just L, in which case the quantifiers are redundant. We conclude 


with the following result. 


11.4.3. COROLLARY. HA is consistent if and only if PA is consistent. oO 


Kreisel’s theorem has the following consequence: classical termination 
proofs can be made constructive. 


11.4.4. EXAMPLE. Consider a formula of the form Variy P(x,y) = 0 with 
primitive recursive P. It can be seen as a specification for an input-output 
relation of a program. A classical or intuitionistic proof of our formula 


176 Chapter 11. First-order arithmetic and Gédel’s T 


asserts that such a program (a recursive function) exists. A program com- 
puting this function can actually be extracted from a constructive proof. For 
this, let us assume that the signature of arithmetic (and perhaps a bit more) 
has been added to AP. Then a formula like Vndm(n = 2:mVn = 2-m-+1) 
is inhabited by a proof, i.e., a lambda term. This lambda term M, applied 
to any specific n, will evaluate to a normal form pack in;(N),m to... for 
a specific value of m. Thus M is actually a program for dividing numbers 
by 2. 


The little missing point in the above example is the “bit more” to be added 
to the lambda calculus. We have specific axioms in arithmetic, most notably 
the induction scheme. And this has to be accounted for by extending the 
lambda calculus by a primitive recursion operator. 


11.5. Kleene’s realizability interpretation 


The BHK interpretation mentioned in previous chapters relies on the infor- 
mal notion of a “construction.” Kleene [60] proposed a way to make this 
precise. 

The idea is that a construction of a formula is a number encoding the 
constructions of the subformulas of the formula. For instance, a construction 
of a conjunction 91 A v2 is a number n encoding a pair of numbers n; and no, 
where nı and no are constructions of yı and ye, respectively. 

The main problematic parts of the BHK-interpretation is in the case 
of implication and universal quantifier. For instance, a construction of an 
implication y — vw is an effective procedure that maps any construction of y 
into a construction of Y. Having settled on N as the domain of constructions 
it is now natural to require that a construction of an implication be a number 
encoding a recursive function that maps any construction of the antecedent 
to a construction of the succedent. 

Below we carry this out in detail, following [61], showing that any formula 
provable in intuitionistic arithmetic has a construction in this sense. 


11.5.1. DEFINITION. Let e € N and ọ be a closed formula of arithmetic. 
Then the circumstances under which e realizes p are defined as follows. 


1. e realizes A, where A is an atomic formula, if e = 0 and A is true; 
2. e realizes %1 A g2 if e = 2° . 3° where a realizes yı and b realizes (9; 


3. e realizes y1 V Yo if e = 2° - 3% and a realizes %1, or e = 2'- 3% and a 
realizes y2; 


4. e realizes yı — 2 if e is the Gödel number of a partial recursive 
function f of one argument such that, whenever a realizes p1, then 
f(a) realizes yo; 
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5. e realizes dry(x), where y(x) is a formula containing only x free, if 
e = 2” .3° where a realizes y(n). 


6. e realizes Vay(x), where y(x) is a formula containing only x free, if e 
is the Gödel number of a general recursive function f of one argument 
such that f(n) realizes y(n), for every n. 


A closed formula y is realizable if there exists a number e which re- 
alizes y. A formula y(21,...,2,) containing only the distinct variables 
T1,--- £k (k > 0) free is realizable if there exists a general recursive func- 
tion f of k variables such that f(ni,... , np) realizes y(m1,... , nx), for every 
N1,-+- nk. 


We shall prove below that every formula provable in HA is realizable. Be- 
fore proceeding with the details it is convenient to introduce some notation 
for partial recursive functions. 

Let us recall again Kleene’s normal form theorem, which we used in 
Section 11.3. The predicate ty is in fact uniform in f, or more precisely 
in the Godel number of f. That is, for every partial recursive function 
f(@1,.--,%n) of n variables, there is a number e such that 


f (x1, ein Ga) = T2 (wy. Tales £1, ezt Arnt) 


where Tn is a certain primitive recursive predicate. Informally speaking, Th 
states that e is an encoding of f, and y is an encoding of a computation of 
the function encoded by e (i.e., f) on input z1,... ,£n. This encoding is a 
pair, and the second component of this pair is the output. The projection 7 
extracts this output from y. The number e is called a Gödel number of f. 
We abbreviate mo(uy. Tale, £1,... , £n, Y)) by ®p(e,21,... , £n). 

Also recall that by Kleene’s S% theorem, there is for every m,n > 0 an 


m + l-ary primitive recursive function S” (z, Y1,... , Ym) such that, if e is a 
Gödel number of the m + n-ary function f(y1,... , Ym, Z1,- -- , En), then for 
each m-tuple (k1, ... , km) of numbers, S% (e, k1,... , km) is a Gödel number 
of the n-ary function f(k1,... , km, £1,- .. Zn). 

When f(y1,--- ; Yn; Z1,- -- ,&m) is an n+m-ary partial recursive function 


with Gödel number e, we denote by 
NG neste) igen SU ne ee Em) 


the function ST (e, Y1,... , Ym): 

Thus, Azı... £n. f (£1, , £n) denotes a Gödel number of the function f 
and Azı... £n-f(Y1,.-- Ym, T1,- -- , £n) denotes a primitve recursive func- 
tion f(y1,.-- , Ym) whose value for each m-tuple (k1, ... , km) of numbers is 
a Godel number of the n-ary function f(k1,... ,km,21,..-,2n). 

We also write {z}(z1,... , £n) for ®n(z,21,... En). 
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We then have for any n-tuple k1,... ,kn of numbers that 


(Ace OTs as iis ine ts oh Mis es oe) 
x f(ki,... Kins Lies oe) 


where ~ means that the two functions have the same domain and have the 
same results on same arguments inside the domain. 


11.5.2. THEOREM. [fF ya y then is realizable. 


PRooF. We use a Hilbert-type formulation of HA: this amounts to the 
Hilbert-type formulation of intuitionistic predicate calculus from Chapter 9, 
together with the axioms for arithmetic in the first section above. 

The proof is by induction on the derivation of Faa y. (This requires 
a generalized induction hypothesis that makes sense for formulas with free 
variables.) We skip most of the proof, showing only two example cases. The 
reader may find the details in §82 of Kleene’s classic [61]. 


1. Let the proof be an instance of the axiom A — B — A for some A, B. 
Then y = A— B — A. We define 


e = Aa.Ab.a 


(does this look familiar?) To show that e realizes y, let a realize A. 
We must show that {Aa.Ab.a}(a) i.e.Ab.a realizes B — A. For this 
end let b realize B, and we must show that {Ab.a}(b), i.e., a realizes A, 
but this holds by assumption. 


2. Let the proof be an instance of (A —> B — C) => (A— B) > A> C 
for some A, B,C. Then: 


e = Ap.Aq.Aa.{{p}(a)} Qa} la)) 


O 
11.5.3. COROLLARY. HA is consistent. 
Proor. There is no number realizing L. O 
11.5.4. COROLLARY. PA is consistent. 
PROOF. Immediate from Corollaries 11.4.3 and 11.5.3. oO 


The proof that all intuitionistically provable arithmetical statements 
have realizers works by mapping proofs into realizers. These realizers are 
numbers coding recursive functions. 

Another similar approach would be to identify the proofs with A-terms 
in an appropriate extension of AP. This would avoid the passing back and 
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forth between functions and encoding of functions. And we would have a nice 
example of a Curry-Howard correspondence. If we define such an extension, 
then consistency of arithmetic should be inferred from normalization: there 
is no normal form of type L. 

In fact, it occurs that we do not need dependent types at all to perform 
a similar construction. It was actually done by Gödel at the simply-typed 
(propositional) level, with help of his System T. 


11.6. Godel’s System T 


We have seen that in A—, the simply typed A-calculus, very few functions can 
be defined. For instance, among the numeric functions, only the extended 
polynomials can be defined. 

In this section we consider Gédel’s system T, which arises from A— by 
addition of primitive types for numbers and booleans and by addition of 
primitive recursion and conditionals for computing with these new types. 
the exposition follows [46] to a large extent. 

It will be seen that AT is far more expressible than A—. The system was 
conceived and used by Gödel to prove the consistency of arithmetic. 


11.6.1. DEFINITION. Gödel’s system T, denoted also by AT, is defined as 
follows. 


1. AT has the same set of types as simply typed A-calculus A—>, with the 
following additions: 
Tus... | int | bool 


2. AT has the same set of terms as simply typed A-calculus A—> à la 
Curry, with the following additions: 
M :=... |z|s(M)|r(M,N,L)|t|f|da(M,N, L) 


3. AT has the same set of typing rules as simply typed A-calculus à—> à 
la Curry, with the following additions: 


[Tr M: int 
[+ z: int [+ s(M): int 


TEM:7r&TFN:7rHint —-7 & Te L: int 
[T+ r(M,N,L):7 


T+ t: bool T F f: bool 


TEM:T&TrTEN:T&T F L: bool 
[T+ d(M,N,L):7 
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4. XT has the same set of reduction rules as simply typed A-calculus A> 
a la Curry, with the following additions: 


r(M,N,z) > M 
r(M,N,s(L)) > N(r(M,N,L))L 


d(M,N,t) => M 
d(M,N,f) => N 


By —>r we denote the union of —g and the above reductions. 


As mentioned above, int and bool denote types for integers and booleans, 
respectively. The term formation operators z and s denote zero and succes- 
sor, respectively, as one might imagine. 

The two first inference rules for int can be seen as introduction rules, 
whereas the third rule for int is an elimination rule. Analogously, z and s are 
constructors of type int and r is a destructor of type int. Similar remarks 
apply to the inference rules and term formation operators for bool. 


11.6.2. REMARK. As always one can study a Church variant and one can 
study a variant in which pairs are included. 


The following two theorems show that the main properties of simply 
typed A-calculus are preserved. In particular, the extra expressibility does 
not come at the expense of loosing strong normalization. 


11.6.3. THEOREM. The relation —7 is Church-Rosser. 


PROOF. By the Tait—Martin-Lof technique. oO 


11.6.4. THEOREM. The relation —>r is strongly normalizing. 


PROOF. By the method of Tait. oO 


Recall that Tait’s method (which applies to AT with very few adjust- 
ments) is based on a construction that assigns a set of terms to every type. 
If we attempt to formalize Tait’s proof, we necessarily must use expressions 
of the form: “For all sets A of terms, satisfying... we have... ”. We can 
talk about terms using their numbers, but one cannot enumerate all possible 
sets of terms, and expressions as the above cannot be coded into first-order 
arithmetic. One needs to quantify over sets of numbers. 

Specifically, Lemma 4.4.3(iii) asserts that for all types o the set |o] is 
saturated. If we could define [o] directly then we could write a formula ¿o (x) 
expressing in arithmetic that x is a member of |o]. Then, the statement of 
our lemma could be expressed in the first-order language. But the definition 
of [ø] is by induction, and there is no single formula expressing the property 
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of being a member of [øo]. The definition of [a] can only be seen as a set of 
postulates about a set (unary relation) variable X. Thus, Lemma 4.4.3(iii) 
can only be formalized as follows: for all types o and all sets X, if X 
satisfies the postulates on |o] then X is saturated. And this involves the 
quantifier “VX”. 

Our first normalization proofs were for simply typed A-calculus. We 
proved both weak normalization by the “simple” Turing-Prawitz technique 
and strong normalization by the “nontrivial” technique due to Tait. There 
are also “simple” proofs of the strong normalization theorem for A —. The 
difference between simple and nontrivial can be given more precise mean- 
ing: the “simple” techniques can be formalized in arithmetic, whereas the 
“nontrivial” can not. 

In the case of AT the situation is different. The Tait proof can be adapted 
to prove strong normalization for AT, but the simple proofs mentioned above 
do not work. In fact, any strong normalization proof for System T must be 
“nontrivial”. See Corollary 11.7.5. 

However, if we restrict attention to finitely many types, the situation 
is different. We no longer need to quantify over all sets, because we only 
need finitely many of them, and these can be explicitely defined by formulas. 
Thus, the whole proof carries over in first-order arithmetic. This situation 
occurs in particular when we deal with a single function f, definable by a 
term F, see Proposition 11.6.10. 

In AT, one can compute with booleans. 


11.6.5. EXAMPLE. Define 


not(M) = d(f,t,M) 
or(M,N) = d(t,N,M) 
and(M,N) = d(N,f,M) 


Then 
not (t) —T f 
not (f) >T t 
and we similarly have the expected reductions for or and and. 
We also have some more reductions. For instance, 
or(t, N) =P t 
However, we do not have 
or(N, t) —T t 
Indeed, one can show that there is no typable term G(x, y) such that both 
G(t, N) >r t and G(N,t) >r t. 


Above we have introduced int as a representation of integers. The fol- 
lowing characterization of normal forms gives the precise interpretation of 
that. 
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11.6.6. PROPOSITION. Let M be a closed normal form and suppose + M : T. 
1. ifr =int then M = m, for some m € N; 
2. if T = bool then M =f or M =t; 
3. if T= > T then M = àz.N. 
In AT one can also compute with integers. 
11.6.7. EXAMPLE. Define for any number n € N: 
n = s” (z) 
Then we can define 


plus( M,N) = r(M,Ax.ày.s(x), N) 


Indeed, 
plus(m,z) = r(m,Ax.ày.s(x),z) 
Sr m 
and 
plus(m,n +1) = plus(m,s(n) 


) 
= r(m,dAzx.Ay.s(x),s(n)) 
>r (Az.Ay.s(x)) (r(m, Ax.Ay.s(Z), m))n 
—r s(r(m, Ax.Ay.s(x), 2)) 
>r s(m+n) 
= m+n+i1 


11.6.8. DEFINITION. A function f : Në — N is definable in AT by a term F 
ift 

1. - F: int* — int; 

2. F(m,... Mmk) =r f(m, Lip): 


It is an easy exercise to show that multiplication, exponential, predecessor, 
etc.. are definable. 

As long as 7 in the typing rules for the new constructs is restriced to 
base types, i.e., bool and int, the functions that can be defined in this 
way are primitive recursive. However, as the type 7 increases, more and 
more functions become definable. In fact, one can show that Ackermann’s 
function is definable in AT (Exercise 11.8.11). 

The system AT is also called the system of primitive recursive function- 
als of finite type, because it makes a system of notation for higher-order 
functions (i.e., functions on functions etc.) defined over the set of integers 
by means of primitive recursion. (The “al” in “functionals” reflects exactly 
the point that we deal with higher-order objects.) 


tint” means int > ... > int (k arrows). 
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11.6.9. REMARK. A construction related to the recursor r is the iterator 1. 
It has form i( M,N, L) with the typing rule 


TEM:7rT&TFN: ror &Te Lz int 
T+ i(M,N,L):7 


and reduction rules 


i(M,N,z) > M 
i(M,N,s(L)) > N (i(M,N,L)) 


The predecessor function satisfying p(s(x)) >r x can be defined by the 
recursor but not by the iterator. However, also the iterator can define the 
predecessor provided one only requires that p(m +1) >r m. In fact, one 
can define the recursor from the iterator and pairing, provided one only 
requires reductions of this form. 


The question arises exactly which functions can be defined in AT. It is 
not difficult to see that every primitive recursive function is definable. It is 
also not difficult to see that not every recursive function can be definable. 
Indeed, suppose otherwise. All terms of type int — int can be effectively 
enumerated, and each of these terms defines a total function (because of 
strong normalization). Thus, we can enumerate all total recursive functions 
of one argument: go, gi,.... But the function h(x) = g,(x) is recursive and 
cannot occur in the sequence. We can have even a tighter upper bound. 


11.6.10. PROPOSITION. All functions definable in XT are provably total in PA. 


ProoF. If a function f is definable by a term F then this term describes an 
algorithm to compute f. Thus, a predicate ty can be effectively computed 
from F and conversely. Proving the formula Vx dy (t(x, y) = 0) thus reduces 
to proving that all applications of the form Fn are strongly normalizable. 
One can do it (with Tait’s technique) so that only finitely many types must 
be considered. All this argument can be coded into arithmetic. oO 


We will see later (Theorem 11.7.7) that the class of functions definable 
in AT coincides with the class of provably total functions of PA. 


11.7. Gödelľ’s Dialectica interpretation 


Gödel introduced System T as a vehicle to prove consistency of PA. More 
precisely, he translates each formula of arithmetic into a statement about 
the primitive recursive functionals of finite type by the so-called Dialectica 
interpretation. The original Gödel’s paper is [48]. We will only sketch the 
main ideas here. More details can be found e.g. in [55, Ch.18]. 
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The basis of the method is a translation of a formula y in the language 
of arithmetic into a term yp of type bool. Suppose first that y is an atomic 
formula. Since all primitive recursive functions and predicates are definable 
in AT, we can define yp so that 


HAF iff pp=rt. 


Here we do not require any additional information about the proof of y to be 
preserved by yp. (This is because primitive recursive statements are treated 
as “observables”. Compare this to 0 realizing all atomic formulas in Kleene’s 
approach.) For complex formulas, we want more. An ideal situation would 
be as follows: yp has one free variable x, and 


HAtyp iff yplx:= M|]=rt, for some M. 


The term M would be the realizer, i.e., it would represent the proof. (Note 
the distinction: yp is a syntactic translation, the computational contents is 
in M.) 

Life is not that easy, and we have to settle for something a little less 
transparent and more complicated. But the essential idea remains the same. 
Below we work in Church-style AT, extended with product types for simplic- 
ity. (This is a syntactic sugar that allows us to identify sequences of types 
(variables etc.) with single types (variables, etc.) if we find it convenient.) 


11.7.1. DEFINITION. 


1. For a term M : bool, with FV(M) = {27}, we write T = M iff 
M|z := Z] =r t, for all closed Z : ø. 


e 


2. We define a \-formula as an expression of the form “Jx°Vy" D(x, y)”, 
where x,y are variables, r and o are arbitrary types, and D(z, y) has 
type bool. 


3. We write T H Jr°Vy’ D iff there exists a term X : o with y g FV(X), 
such that T = D[x := X].° 


The variables x and y in the above definition, part (2) may be of product 
types, thus actually may represent sequences of variables. 


11.7.2. DEFINITION. For each formula y in the language of arithmetic, we 
define a A-formula y? = JxVy yp by induction with respect to ¢. 


e If vis an atom (a primitive recursive relation) then gy? = Ja™*Vyint vp, 
where yp is a term which defines this relation in AT, and x and y are 
fresh variables. 


5The term X should be seen as parameterized by the free variables of D, except y. 
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Note that L is a primitive recursive relation. Thus, as Lp we can take e.g. 
the term f. Also note that the quantifiers da'™*Vy'™* are redundant and 
introduced here just for uniformity. 

Let now assume that Y? = Jar?Vy" yp(x, y) and YP = JuPVul wp(u, v). 
Then: 


p Ap)? = Acuvyo(yn(2,y) A Yolu, v)); 


p V p)? = AzMauvyo((z = 0 > pp) A(z #0 > Yp)); 


= Ju Py 4 Vau(yp(2, yizv) > wp(m2, v)); 


z7 Mar( pp (a, 2@)); 


And now take y? = Ja?Vy" yp(a, y, zi). Then 


e (3z p)” = dzaVy yp(z, y, z); 


© (Yz p)? = Jam -eVyzyp(21z,y, 2) 
11.7.3. THEOREM (Gödel). If HA F y then TE pP. 


PROOF. The proof is by induction with respect to the proof of y. We omit 
this proof, which can be found in [55, Ch.18}. oO 


The proof of the above theorem is actually building a realizer X for a given 
proof in HA. The computational contents of the proof in HA is preserved 
by the realizer as we will see below. Here are some consequences of the 
interpretation. 


11.7.4. COROLLARY. HA is consistent. 


PROOF. Suppose HA F L. Then T — Lp, i.e., we have f =r t. O 


11.7.5. COROLLARY. The strong normalization theorem for System T is a 
statement independent from PA Ê 


PROOF. Otherwise, all the proof of SN would be formalizable in PA. This 
contradicts Theorem 11.2.2. oO 


The above result can be explained as follows. Gödel’s consistency proof 
makes use of the normalization theorem for AT, and every other part than 
this latter result can be proved in PA itself, provided we go through the effort 
of translating terms to numbers by some Gödel-numbering. By Gödel’s the- 
orem about the unprovability of consistency of arithmetic within arithmetic 


SSN is expressible in the language of arithmetic with help of König’s Lemma: “For 
each (Gédel number of a) term M there is n such that all reduction paths from M (coded 
by a Gödel number) consist of at most n steps”. 
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it follows that the normalization therem cannot be proved in PA—unless 
PA is inconsistent. 

Thus, in proving the normalization for AT we must be using methods 
which essentially transcend proof techniques that are formalizable in PA, 
i.e., induction over natural numbers. 

In normalization proof for simply typed A-calculus we used induction 
on lexicographically order triples, and similarly in the proof of Gentzen’s 
Hauptsatz (the cut-elimination theorem). Such inductions can be reduced 
to nested inductions and are therefore still formalizable in PA. 

One can also view induction on lexicographically ordered tuples as an 
ordinal induction—induction up to w’—which happens to be formalizable 
in PA. Gentzen discovered that by moving to larger ordinals, one could prove 
a cut-elimination theorem for arithmetic. More specifically he considers 
induction up to €9. This is the first ordinal that cannot be reached by 
addition, multiplication, and exponentiation. 

Also, one can show that the functions definable in AT are the functions 
which are definable by transfinite recursion up to the ordinals which are 
strictly smaller than €o, see [96]. This shows that the expressive power 
of AT is enormous. 


11.7.6. COROLLARY. All functions provably total in first-order arithmetic 
are definable in T. 


PROOF. Without loss of generality we can consider a unary function. As- 
sume PA F Va dy (t(x, y) = 0), where ty is as in Definition 11.3.3. Recall 
that t(x, y) = 0 is primitive, and thus treated as an atomic formula. Thus, 
the translation of the above formula (after removing redundant quantifiers) 
has the form 


(Var Iy (t p(x, y) = 0))? = Sy Ve" D(yie, x), 


where D represents the relation t¢(a, y) = 0. 

Since HA — (Va 3y (t(x, y) = 0))?, we have a realizing term Yj, such 
that D(Yin,n) reduces to t. Let Yin =r m. Then we have t(n,m) = 0, 
and thus f(n) = 72(m). Clearly, the projection is primitive recursive and 
represented by some term IIg. The conclusion is that the term Az.Il2(Yi2) 
represents f in System T. oO 


Together with Proposition 11.6.10, this gives: 


11.7.7. THEOREM. The functions definable in AT are exactly those that are 
provably total in PA. 


11.7.8. REMARK. Let us now come back to the idea mentioned in Exam- 
ple 11.4.4 of a variant of AP corresponding to first-order arithmetic. We 
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shall argue that System T can be seen as a propositional counterpart of 
such a calculus. Indeed, let us consider again the induction scheme 


(Va:int)(y(z) —> y(x +1)). > (0) > (Varint)y(z). 


In order to incorporate arithmetic into AP one has to make sure that every 
such type is inhabited. One way to do it is to introduce new constants Ry 
of the above types. A proof by induction is now represented by a term 
R, MOmanto) >e) weg of type (Yx:int)y(x). 

The next question is what should be a reduction rule associated with Ry. 
Let n : int be a specific integer. The term R,MNn represents a proof 
of y(n) obtained as follows: first prove the general statement (Vx:int) p(x) 
by induction and then apply it to n. Such a proof can be seen as containing 
a redundancy: an introduction of universal quantifier by Ry, followed by 
elimination of that quantifier. We can avoid redundancy by applying M 
to N exactly n times instead. This justifies the reduction rules: 


e R,MNO >; N; 
e R,MN(n+1) >g Mn(R,MNn). 


Now observe what happens to our constant under the dependency erasing 
translation M ++ M. The type of Rọ becomes: 


(int => y > p) > y `> int > y(x), 


which is, up to permutation, the same as the type of the recursor r. Also, 
the reduction rules above differ from those of Definition 11.6.1(4) just in the 
order of arguments. 


11.8. Exercises 


11.8.1. EXERCISE. Show that the following theorems are derivable in PA: 


e Va (=(x = 0) > Ay(y = z + 1)); 

e YVrYyYz (z =yroy=2z>2=2); 
e VaVyVz((at+y)+2=24+(yt+2)); 
e YVrYy (zr +y =y+ r); 


e 2+2=4; 


e Vely (a =2-yVar=2-y+4+1); 


e other common arithmetical properties. 
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11.8.2. EXERCISE. Check whether the axiom scheme VæYy (y(x) > x = 
y — (y)) of PA can be replaced by VaVy (x = y > z +1 = y + 1) and 
VaVyV2 (z =y > y=z>r=2z). 


11.8.3. EXERCISE. Show that every function representable in PA is strongly 
representable (and conversely). Hint: Consider the formula: 


(Alz y(Z, z). A p(z, y)) v {a!z yg, z). Ay = 0). 


11.8.4. EXERCISE. Show that the condition (2) in Definition 11.3.1 can be 
replaced by: 


2’) PAF Sy y(t, y), for all ñ € NF; 


2”) N E (ñ, m) implies f(n) = m, for all % and m. 
Hint: Consider the formula: (7, y) A Yz (~(@, z) > y < z). 


11.8.5. EXERCISE. Consider again the formulas of Exercise 11.8.1. Are they 
provable in HA? 


11.8.6. EXERCISE. Prove part 1 of Theorem 11.4.1. 


11.8.7. EXERCISE. Let @ be a fixed formula. For any formula y, let y? be 
obtained from y by replacing every atomic subformula v by v V y. Show 
that if HA F vy then also HA F ọ®. 


11.8.8. EXERCISE (H. Friedman). Prove Theorem 11.4.2, using Exercise 11.8.7 
as a lemma. Hint: Take ọ to be dy(tp(Z, y) = 0), and apply Exercise 11.8.7 
to the formula ~>Jy(t (2, y) = 0). 


11.8.9. EXERCISE. Show that multiplication, exponentiation, subtraction, 
and all your favourite integer functions are definable in AT. 


11.8.10. EXERCISE. Here are our favourite integer functions: let fọ be the 
successor function, and define fk+ı(x) := f?(x) (apply fk to x exactly x 
times). Show that all functions fg are definable in AT. 


11.8.11. EXERCISE. The Ackermann function fu is defined by f(x) = f(x). 
Prove that the Ackermann function is not primitive recursive. Hint: Show 
that every primitive recursive function is majorized by one of the f;’s. 


11.8.12. EXERCISE. Show that the Ackermann function fy (Exercise 11.8.11) 
is definable in AT. 


11.8.13. EXERCISE. Show that all functions fu+k+1(£) = f%,,(a) are defin- 
able in AT, as well as the function fw-2(£) = fo+z(£). 
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11.8.14. EXERCISE. Go ahead, define even faster growing functions, all de- 
finable in AT. Will this ever stop? 


11.8.15. EXERCISE. Show that all functions definable in A— are definable 
in AT. Too easy? Do not use Schwichtenberg theorem. 


11.8.16. EXERCISE. Show that Booleans make syntactic sugar in AT, that 
is, the class of integer functions definable in AT without Booleans is the 
same. 
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CHAPTER 12 


Second-order logic and polymorphism 


We often say that individuals are objects of order zero. Functions and 
relations on individuals are of order one. Further, operations on objects of 
order n will be themselves classified as being of order n+1. This terminology 
is often used in the metalanguage, referring to problems, systems etc. For 
instance, the unification problem discussed in Chapter 6, is often called 
“first-order unification”. Note that the unified expressions (unknowns) are of 
order zero, its the unification itself (an operation on terms) that is first-order. 
One can also consider second-order unification, with function unknowns and 
so on. 

We talk of “first-order logic”, because we have first-order predicates, and 
because quantification can be seen as an operator acting on individuals. So 
what “second-order logic” should be? Typically, one adds to the language 
variables ranging over predicates, sets or functions, and quantify over such 
variables. Thus, second-order logic is usually an extension of first-order 
logic. However, in presence of second-order quantification, the first-order 
features become less important than one could expect, and many properties 
of second-order logic can be studied in a simplified settings: propositional 
second-order logic. This logic is obtained by adding second-order features di- 
rectly to propositional calculus. That is, quantifiers are now binding propo- 
sitional variables. 


12.1. Propositional second-order formulas 


We extend the language of propositional logic by second-order quantifiers, 
i.e., quantifiers over propositions. As before, we assume an infinite set PV of 
propositional variables and we define the second-order propositional formulas 
by induction, represented by the following grammar: 


28 ::= L | p | (26 — 26) | (28 v 28) | (2H A 28) | Vp2® | Ap 24, 
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where p ranges over PV. The quantifiers are meant to bind propositional 
variables within their scope, so that e.g., FV(Vpy) = FV(y) — {p}. (We 
skip the full definition of FV, leaving this pleasure to the reader, as well as 
another one: to define the operation of substitution y[p := w].) We identify 
alpha-convertible formulas. Notational conventions are similar to those used 
for propositional and first-order logic. 

The intended meaning of “Vp y(p)” is that y(p) holds for all possible 
meanings of p. The meaning of “dp y(p)” is that y(p) holds for some mean- 
ing of p. Classically, there are just two possible such meanings: the two truth 
values. Thus, the statement Vp y(p) is classically equivalent to y(T)Ay(_), 
and dp y(p) is equivalent to y(T)Vy(L). Therefore, every property express- 
ible with quantifiers can be also expressed without.! In fact, every function 
over the two-element Boolean algebra {L, T} can be defined with help of 
ordinary propositional connectives (this property is called functional com- 
pleteness) and thus no extension at all of the propositional language can 
increase its expressive power. 


12.1.1. WARNING. The above is no longer true when we add second-order 
quantification to first-order classical logic, and when the quantified predi- 
cates may depend on individual terms. These are no longer just truth-values, 
but rather truth-valued functions on individuals. 


In the intuitionistic logic, there is no finite set of truth-values, and the 
propositional quantifiers should be regarded as ranging over some infinite 
space of predicates. (In fact, there is nothing like functional completeness: 
Kreisel [64] and Goad [47] show predicates non-expressible in propositional 
intuitionistic logic but definable with help of quantifiers or infinite opera- 
tions.) 

The intuitive meaning of quantified expressions is best explained by 
means of the Brouwer-Heyting-Kolmogorov interpretation. Note that we 
deal only with propositions expressible in our language. Indeed, to handle 
the predicates in a constructive way, we must be able to refer to their proofs. 


e A construction of Vpy(p) is a method (function) transforming every 
construction of any proposition P into a proof of p(P). 


e A construction of 3p (p) consists of a proposition P, together with a 
construction of P, and a construction of y(P). 


Syntactically, predicates P must be themselves represented by formulas. The 
class of formulas quantifiers range over can be taken to be the full set 2®, or 
a proper subset of 26. We choose the first option (called full comprehension) 
so that the following schemes are valid (for every y): 


'But at a certain cost: compare the PSPACE-completeness of satisfiability of quantified 
Boolean formulas to the NP-completeness of ordinary propositional formulas. It follows 
that removing quantifiers may cause an exponential increase of the size of a formula. 
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e Ypo. > plp := 4]; 


e Ipp > p). 


One has to be aware that the full comprehension postulate has the follow- 
ing side-effect, called impredicativity of second-order logic. The meaning of 
a formula Vpy is determined by the meanings of all formulas y[p := J, 
including the cases when w is either equal or more complex than Vp ọ it- 
self. There is no well-founded hierarchy with respect to the semantics, in 
particular many proof methods based on induction must fail. 

On the other hand, the assumption that quantifiers range over definable 
propositions only is a sharp restriction compared to the ordinary understand- 
ing of (full) second-order classical logic, as in Warning 12.1.1. However, from 
a constructive point of view, a proof and not a model is the ultimate cri- 
terium, and thus the syntactic approach should be given priority over the 
semantic way of thinking. See also Remark 12.2.7. 


12.1.2. DEFINITION. Natural deduction. 
The natural deduction system for second-order intuitionistic proposi- 


tional logic consists of the ordinary rules for propositional connectives plus 
the following rules for quantifiers: 


Trg TEVpyp 
(Dyes Oe FV) (Ona d 
a CF yl[p:= ù] sl Papo. T,pF 4 
(31) Tepo. (3E) Tee (p Z FV(T,W)) 


In the above, the notation FV (T) is the union of all FV (o), for ọ ET. 

One can also define other proof systems, most notably sequent calculus 
for second-order propositional intuitionistic logic. Cut-elimination proofs 
for this calculus were obtained independently by several authors; three of 
them (by Girard, Martin-Löf and Prawitz) are published in the book [34]. 


12.2. Semantics 


We begin, as usual, with the algebraic approach, based on Heyting algebras, 
although, historically, second-order Kripke semantics was considered first. 


12.2.1. DEFINITION. Letv: V — H be a valuation of propositional variables 
in a complete Heyting algebra H. We extend v to arbitrary second-order 
formulas as follows: 


© v(p Vp) = vle) Voly); 
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e u(Vpy) = inf{up(y) : a E H}; 


e v(dpy) = sup{vp (p) :a E H}. 


where vy is a valuation defined by vj (p) = a, and vp (q) = v(q), for q # p. 


We use the symbol H in the obvious way, except that we deal now 
exclusively with complete algebras. For instance, we write = ọ (and we 
say that y is a tautology) iff y has the value 1 under all valuations in all 
complete Heyting algebras. 


12.2.2. THEOREM (Heyting completeness). The conditionsT = y andT F y 
are equivalent. 


PROOF. Omitted.? See the paper [40] for details. oO 


The paper of Geuvers [40] is suggested for reading, but algebraic semantics 
for various second-order and higher-order intuitionistic logics was known 
before Geuvers, cf. the work of Albert Dragalin [32]. 

Kripke semantics for second-order propositional formulas was considered 
by several authors. There are various sorts of models and different variants 
of the logics under consideration. One should begin with a reference to 
Prawitz [86], who first proved a completeness theorem for a class of Beth 
models, structures similar in spirit to Kripke models. Then, Gabbay [36, 37] 
showed completeness for a slight extension of our second-order logic for a 
restricted class of Kripke models. This result was adjusted by Sobolev [100] 
so that the Gabbay’s axiom (see Remark 12.2.5) was no longer necessary. 
We recommend the paper [99] of Skvorov for a survey of these results. Our 
definition below follows the latter paper (up to syntactic sugar). 


12.2.3. DEFINITION. 


1. A second-order Kripke model is a tuple of the form C = (C,<,{D-: 
c € C}), where C is a non-empty set, < is a partial order in C, and 
the D,’s are families of upward-closed® subsets of C, satisfying 


ifc < c then De C De. 


The intuition is that De is the family of predicates meaningful at 
state c. 


2A difficulty in this proof is that the Lindenbaum algebra of second-order formulas is 
not complete and has to be embedded into a complete one in such a way that the existing 
joins and meets are preserved. 

[If c €x € De and c < c" then also c” € g. 
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2. A valuation in C assigns upward-closed subsets of C to propositional 
variables. Such a valuation v is admissible for a state c iff v(p) € De, 
for all propositional variables p. Clearly, a valuation admissible for c 
is also admissible for all c’ > c. We write v, for a valuation satisfying 
up (p) = x, and v5 (q) = v(q), for q # p. 

The forcing relation c, v IF ọ is defined (when v is admissible for c) as 

follows: 


e cvl p iff cE v(p); 

e cvl ovy iff cvik yor c, v lF y; 

ecuvlkypAw iff cult yand c,v IF y; 
ecuvlkyoy iff c,uvlk y, foral d > c with d,v IF gy; 


e c,v |F L never happens; 


e cvik Ipp if c, v3 IF o, for some x € Des; 


e cvl Vpp if c,u5 IF ọ, for all d >c, and all z € De. 


3. A Kripke model is complete iff for every formula y, every c and v, the 
set u(y) = {c’: c,v IF p} is in De, whenever v is admissible for c. (If 
we understand the meaning of propositional variables free in y then 
we should understand the formula too.) 


4. We write I IF iff for every complete Kripke model C, every c € C 
and every valuation v admissible for c, such that c, v forces all formulas 
in I, we also have c,v IF y. 


The completeness theorem for Kripke models in the form below should prob- 
ably be attributed to Sobolev [100]. 


12.2.4. THEOREM (Kripke completeness). The conditions T lk p and TF p 
are equivalent. 


12.2.5. REMARK. The additional axiom scheme used by Gabbbay is: 


Vp( V v(p)). = Y V Yp (p), where p ¢ FV (4%). 


This is a classical second-order tautology, but not an intuitionistic tautology. 
The class of models corresponding to propositional second-order intuition- 
istic logic extended with Gabbay’s axiom (called also Grzegorczyk schema) 
is obtained by postulating that all De are equal to each other (models with 
constant domains). 


12.2.6. REMARK. Note that the postulate of completeness of Kripke models 
reflects the idea of impredicativity. Indeed, it guarantees that the range of 
a quantified variable includes every definable predicate. In fact, if we do 
not require completeness, the following tautology schemes (expressing full 
comprehension) would be no longer valid: 
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e Ypo > plp := 4]; 


e Ipe p). 


Observe that completeness cannot be replaced by a modified definition of 
forcing, 


cv lF Ypy iff c, ug) lk y, for all >c, and all formulas 4, 
because such a definition would be circular. (Take y = Ypo.) 


12.2.7. REMARK. It is tempting to consider Kripke models with all De equal 
to the family of all upward-closed subsets of C (principal Kripke models). 
Unfortunately, the class of all formulas valid in principal models is not re- 
cursively enumerable, and thus non-axiomatizable in a finitary way. This 
result is due to Skvorov [99] and independently to Kremer [65]. 


Of course the above mentioned results of Skvorov and Kremer imply 
that the set of second-order sentences true in all principal models cannot 
be decidable or even recursively enumerable. The set of provable sentences 
of our second-order intuitionistic logic is of course recursively enumerable. 
But it is undecidable. 


12.2.8. THEOREM. 
It is undecidable whether a given formula y € 2® has a proof. 


The first proof of undecidability was given by Gabbay [36, 37]. But this proof 
applies to the logic extended by Gabbay’s axiom (see Remark 12.2.5), and 
it does not extend automatically to the pure intuitionistc case. The proof is 
using completeness theorem, for Kripke models with constant domains. The 
paper [100] of Sobolev filled this gap, and allowed to infer Theorem 12.2.8 by 
essentially the same method. In the meantime, M.H. Lob [67] has published 
another proof of Theorem 12.2.8. The main result of [67] which implies 
undecidability, is an effective translation from first-order classical logic to 
second-order intuitionistic logic. Unfortunately, L6b’s paper is quite in- 
comprehensible. It has been later slightly simplified by Arts [3] and Arts 
and Dekkers [4], but the resulting presentations are still quite complicated. 
A simpler, syntactic proof of Theorem 12.2.8 can be found in [112]. 


12.3. Polymorphic lambda-calculus (System F) 


The polymorphic lambda-calculus 2, often referred to as “System F” is an 
excellent example of a Curry-Howard correspondence and provides a surpris- 
ing evidence for the relationships between logic and computer science. This 
system was actually invented twice: by the logician Jean-Yves Girard [44] 
and by the computer scientist John Reynolds [90]. The first one’s goal was 
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to design a proof notation needed for his work on second-order logic, the 
other’s idea was to build a type system for a polymorphic programming 
language. The results (after dissolving the syntactic sugar) were essentially 
the same. 

For a treatment of System F extending the scope of the present notes, 
one can consult the following books: [45, 66, 74]. 


12.3.1. DEFINITION. 


1. (Second-order) types are defined as follows: 


e Type variables are types; 
e If o and 7 are types then (a — 7) is a type; 


e Ifo is a type and a is a type variable, then Vac is a type. 


Thus, types coincide with second-order propositional formulas over —> 
and V only. 


2. Well-typed lambda-terms (Church style) are defined by the type infer- 
ence rules below. Every term is either a variable, an ordinary applica- 
tion or abstraction, or it is 


e a polymorphic abstraction, written Aa.M, where M is a term and 
qa is a type variable, or 

e a type application, written (Mr), where M is a term and 7 is a 
type. 


The intuitive meaning of Aa.M is that the term M (which may refer to a 
free type variable œ) is taken as a polymorphic procedure with a type param- 
eter a. Type application correspond to a call to such a generic procedure 
with an actual type parameter. This is an explicit form of polymorphism 
(type as parameter) as opposed to implicit polymorphism of ML. 


12.3.2. DEFINITION (Type inference rules). A contezt is again a finite set of 
declarations (x : T), for different variables (i.e., finite partial function from 
variables to types). The axiom and the rules for — are as usual: 


air Pas 


TFN:t->o0 TFEM:7 Bair Mto 
FENM z0 T+ AT:T.M:T >o 


and we also have rules for V corresponding to natural deduction rules (VI) 
and (VE) 


TrFM:oa TEM :Vao 
(a g FV(T)) 
T F (Aa.M) : Yacc TE MrT: ola := rT] 
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Let us recall that a Church-style term makes sense for us only within a con- 
text that assigns types to free variables. We sometimes stress this fact by 
placing (informally) an upper index, as for instance in gv) pyole=T] | In 
fact, finding a proper decoration of free variables in a given term expres- 
sion (to obtain a proper Church-style term) is, surprisingly, an undecidable 
problem, see [95]. 


12.3.3. CONVENTION. As in previous chapters, we sometimes write upper 
indices to mark types of certain (sub)terms. Also, we sometimes write e.g. 
Aa’. M, rather than Ax:7. M, to improve readability. 


As should be now clear from the rules, the universal type Va o(a) corre- 
sponds to a product construction of the form [[,-, 0(7). This answers very 
well to the idea that a proof of Va o(a) is a function translating proofs of T 
into proofs of o(T). 

From the programmer’s point of view, Vac is a type of a polymorphic 
procedure. Note that the restriction a ¢ FV (T) in the V introduction rule 
(called also generalization rule) corresponds to that a type parameter must 
be a local identifier. 


12.3.4. EXAMPLE. Here are some well-typed Church-style terms: 


ef Aa.(Ar’O> .2(B — 8)(x8) : VB(Va(a > a). > 8 > B); 


et Aa. Af Axe. f(fx) :Va((a > a) > (a > a)); 


yf AFOSE) Aart. f (Ba) fax) : Vala > b > a). > Vala > 
B> b> a). 


12.3.5. THEOREM (Curry-Howard isomorphism). We have [+ M :7 in the 
polymorphic lambda calculus if and only if |T| 7 has a proof in the {V, >}- 
fragment of the second-order intuitionistic propositional logic. 


12.3.6. COROLLARY. The inhabitation problem for the polymorphic lambda 
calculus (“Given type T, is there a closed term of type T?”) is undecidable. 


PROOF. Immediate from the above and Theorem 12.2.8. O 


12.3.7. WARNING. We skip the detailed definition of free variables and sub- 
stitution. The reader should be able to write this definition herself, provided 
she remembers about the following: 


e There are free object variables in terms as well as free type variables. 
The latter occur in the lambda abstractions “Ax:7T” and in type appli- 
cations. Thus we have to consider substitutions of the form M[x := N] 
and of the form M[a := 7]. 
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e There are two binding operators in terms: the big and the small 
lambda. Substitutions must account for both. And note that the 
term N in M[zx := N] may contain free type variables that are bound 
in M. Thus, both sorts of renaming may be necessary. 


e The definition of alpha conversion must account for the two sorts of 
bindings. 


e Binding an object variable x? does not mean binding type variables 
in p. 


The effect of substitution z[a := T] is of course æ. But if we work 
in a context containing a declaration (x : o), then one should better 
understand it this way: «7[a := 7] = x7!%=7!, This is because what 
we want is Dla := 7] Mla := T] : ola := T] whenever DF M:o. 


12.3.8. DEFINITION (Beta reduction). 
There are two sorts of beta reduction rules: 


e Object reduction: (Axv:7.M)N —>g M[x := N]; 
e Type reduction: (Aa.M)t —>+g M[a := T]. 


This notion of reduction has the expected properties, in particular it is 
Church-Rosser and preserves types. 


12.4. Expressive power 


In classical logic, the connectives =, V and A can be defined by means of 
L and —. The quantifier 4 is also expressible via the De Morgan law, so 
that L, — and V make a sufficient set of operators. This is not the case in 
intuitionistic logic, neither propositional nor first-order. However, in second- 
order propositional logic, this opportunity appears again. And we can even 
get more: using — and V one can express the other connectives and also 
the constant L. We have postponed these definitions until now, in order to 
accompany them with term notation. 


12.4.1. DEFINITION (Absurdity). We define 
L := Vaa. 
We have the following term assignment to rule (EL): 


THM: 
TrTEAHMT:T 
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It is easy to see that there is no closed term in normal form that can be 
assigned type Vaa. It will follow from strong normalization that L is an 


empty type. 


12.4.2. DEFINITION (Conjunction (product)). 
Let a be not free in 7 nor ø. Then 


TA\o:=Va((t >o >a) a). 

(Read this definition as: T \o holds iff everything holds that can be derived 
from {7,o}.) 

Lambda-terms related to conjunction are pairs and projections. We 
define them as follows: 

© (P,Q) := ane oe PO: 

© mı( M^) := Mr(Aa Ay’. £); 

© 2(M7*?) := Mo(AxT Ay’. y). 
It is left to the reader to check that the term assignment to the ^-related 


rules of natural deduction, described in Section 4.2: 


TEM:y TEN:ig TE M:vAgp TE M:vAgp 
TF<M,N>:0AgQ T+ m(M):y r F m2(M): 9 


is correct, as well as the beta-reduction 7;((P, P2)) >g P; is implemented 
(but with —g replaced by —»g). Note however that eta-conversion is not 
implemented: if y7” is a variable then (71(y),72(y)) is a normal form. 


12.4.3. DEFINITION (Disjunction (variant)). 

We define the disjunction of 7 and o as their weakest common conse- 
quence. That is, 7 V ø holds iff all common consequences of 7 and ø hold. 
Formally, for a g FV(o) UF V(r), we take: 


TV 0 :=Va((t > a) > (o > a) >a). 
We define injections and case eliminator this way: 
e inı( M7) := Aadu™ AvA. uM; 
e ino( M°) := Aau? tAv? uM; 


e case(L7Y?; 27.M?; y?.N?) := Lpo(AxT.M) (Ay? .N). 
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The reader is invited to check the correctness of rules: 


TEM:y rF FM: 
r F in(M): yve Tr F in(M): vv 


TF L:yVoy Tja:vk M:p Tyy:gt Nip 
Tr F case(L;2.M;y.N) : p 


as well as the correctness of beta reduction (Exercise 12.7.6). 

Before we discuss the existential quantifier, let us observe that various 
data types can be implemented in System F. For instance, type Bool can 
be interpreted as Va(a —> a — a), with true = Aadr*y*.x and false = 
Aadx“y®. y. Integers are represented by the type 


w := Valla > a)> a > a), 
with the polymorphic Church numerals 
Cn = AaA fT Oa. f(f(x) ) 


representing numbers. We can now generalize the notion of a definable 
integer function in the obvious way. Clearly, all functions definable in simple 
types can also be defined in System F by simply adding some A’s at the 
beginning. For instance, we define the successor function as: 


succ := An” Aa. Af x”. f(nafa). 


But one can do much more, for instance the function n + n” can be defined 
as follows: 
Exp := An”. n(a > a)(na). 


Note that this trick uses polymorphism in an essential way. We can general- 
ize it to represent primitive recursion. Indeed, System T (as an equational 
theory) can be embedded into System F. 


12.4.4. PROPOSITION. For a given type o, define ro : o > (o > w > 0) > 
w —> o as the following term: 


AYASI TETT AnA. mi (n(onw) (Av. (FC (v))(rlw)), suce(r2(v)))) (y, co)). 
Then ro MN (co) =g M and ro MN (succe(n)) =g N(roMNn)n, 


PROOF. Exercise 12.7.8. O 


The reader is invited to define representation of various other data types in 
Exercise 12.7.7. 

Let us now consider the existential quantifier. We need a term assign- 
ment the introduction and elimination rules. One possibility is as follows: 


202 Chapter 12. Second-order logic and polymorphism 


PEM: ola := 7] 
T F pack M,7 to da.a: da.o 


(AD) 


TEM:dao0 T,xz:oFN:p 
T - abstype a with «:cis M in N: p 


(SE (a g FV(T, p)) 


As in the first-order case, existential quantification corresponds to data ab- 
straction. An existential type of the form Jao can be seen as a partial type 
specification, where type a is “private” and not accessible for the user. For 
instance, one can consider a type of push-down stores (with the push and 
pop operations) defined as 


w-pds := Ja(a ^A (w > a > a) A (la > a ^w)). 


A user can operate on such a pds without knowing the actual type used to 
implement it. A generic pds type may now be defined this way: 


generic-pds := YBJala A (B —> a > a) A (la >a ^ b)). 


The beta reduction rule for existential type constructors is as follows: 


abstype a with xz: ø is pack M,7 to Ja. o in N —+g Nia := T][xz := M]. 


This corresponds to using an abstract type in a context where an actual 
implementation may be hidden from the user. More on existential types can 
be found in Mitchell’s book [74]. 


Existential quantification can be represented in System F as follows: 


12.4.5. DEFINITION. Assuming 8 Z FV(c), we define 


dao :=VB(Va(o —> B). > p). 


The packing and unpacking terms are as follows: 


e pack M,7 to Ja. o = AB.AcY“O79) xTM; 


e abstype a with z : o is M in N? = Mp(àa. àx". N). 


Compare the above definition to Definition 12.4.3. We again have the weak- 
est common consequence of all o(a), for arbitrary type a. This supports 
the understanding of existential quantifier as infinite disjunction. But note 
also that there is a similarity to De Morgan’s law here: take L instead of 8 
and we obtain ~Va-a. We leave to the reader the verification that beta 
reduction is correctly implemented. 


12.5. Curry-style polymorphism 203 


12.5. Curry-style polymorphism 


The Curry-style variant of System F is defined by the following type assign- 
ment rules for pure lambda terms. These rules correspond exactly to these 
in Definition 12.3.2. (The notion of a type and a context remains the same.) 


PAT EEE 


rTE-N:rTr>o TEM:7 T,z:TrTFM:0 
TENM:0 ThAg.M:tT-o 

TFM: rE- M :Yaoc 

~~ (lag FV(I)) 

TEM:Vac TEM :ola:=7] 


Rules for abstraction and application are the same as for the simply-typed 
Curry-style lambda-calculus. Rules for introducing and eliminating the uni- 
versal quantifier (called respectively generalization and instantiation rules) 
reflect the idea of implicit polymorphism: to have the universal type Vat 
means to have all possible instances of this type (all types r[a := ø]). 


12.5.1. DEFINITION. The erasure map |: | from terms of Church-style Sys- 
tem F to pure lambda terms, is defined by the following clauses: 


|e] = g 
|MN| = |M||N| 
|Az:o. M| = Az.|M| 
|Aa.M| = |M| 
|\Mr| = |M| 


12.5.2. PROPOSITION. For a pure lambda term M, we have T F M : 7 if and 
only if there is a Church-style term Mo with |Mo| = M, such that F Mo: T. 


PROOF. Easy. 


A Church-style term Mp can be seen as a type derivation for a Curry- 
style term |Mo|. The following theorem follows from the fact that every 
beta reduction performed in a typable pure lambda term corresponds to a 
reduction in the corrsponding Church-style term. 


12.5.3. THEOREM (Subject reduction). Let T E M : 7, for a pure lambda 
term M. Then M —g M' implies TF M':7. 


PROOF. Omitted. oO 
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The above result is not as obvious as it can perhaps appear at the first look. 
To see this, consider the following example: 


12.5.4. EXAMPLE. We have the following correct type assignment: 
r:a>VE(B— B)FAy.ry:a— B- pP, 
and the eta-reduction Ay. xy —, x. However, 
r:a >Y >P) Y r:a > b> h. 


Observe that the Church-style term corresponding to Ay. xy in our example 
is Ay:a. xy and is not an n-redex. Thus, the reason why Curry-style Sys- 
tem F is not closed under 7-reductions is that there are Curry-style 7-redexes 
that do not correspond to any Church-style redex. 


12.5.5. REMARK. Closure under 7-reductions can be obtained (see Mitchell’s 
paper [73]) by adding to the system a certain subtyping relation < together 
with a subsumption rule of the form 


TEKEM:7, TSO 
TEM :o. 


12.5.6. REMARK. Adding existential quantification to Curry-style version of 
System F results with the same problem as that described in Section 9.10. 
See Exercise 12.7.10. 


With polymorphism, one can assign types to many pure lambda terms 
which are untypable in simple types. A prominent example is Av. xx, and 
another one is co2K. As we will see below, only strongly normalizable terms 
can be typable, because of strong normalization. But there are strongly 
normalizable terms, untypable in F. The first such example* was given by 
Simona Ronchi Della Rocca and Paola Giannini in the paper [43], and it is 
the following term: 

(Azy. y(zI)(zK)) (Az. xz). 
The essential thing here is that we cannot find one type for (Av. xx) that 
could be applied to both I and K. Another example is: 
cocoK. 


Compare the latter to the typable term co(c2K). 

It was long an open question whether the type reconstruction and type 
checking problem for System F was decidable. Both were shown undecidable 
by Joe Wells. 


12.5.7. THEOREM (Wells [117]). Type reconstruction and type checking in 
the second-order -calculus are recursively equivalent and undecidable. 


PROOF. Too long. Oo 


‘apparently based on an idea of Furio Honsell. 
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12.6. Strong normalization of second-order typed A-calculus 


We end the chapter by extending the proof of strong normalization of simply 
typed A-calculus from Chapter 4 to second-order typed A-calculus à la Curry. 
As mentioned earlier, the standard method of proving strong normaliza- 
tion of typed A-calculi was invented by Tait [104] for simply typed A-calculus 
and generalized to second-order typed A-calculus by Girard [44]. 
Our presentation follows again [8]. 


12.6.1. DEFINITION. 


(i) The set of type variables is denoted U and the set of second-order types 
is denoted by Ig. 


(ii) A valuation in S is a map 
€:U SS. 
(iii) For a valuation €, define the valuation €{a := X} by: defined by 


Os AM { ae ce 


(iv) For each valuation € in S and each ø € Ilo the set [o]¢ is defined by: 


[ale = g(a) 
[o> rle = [ole > [le 
[Vao] = Nxesloleta:=x} 


12.6.2. LEMMA. For each valuation € in S and o € Ig, we have [ole € S. 


PROOF. Similar to the corresponding proof for A>. oO 


12.6.3. DEFINITION. 


(i) Let p be a substitution (i.e., a map from term variables to A), and € be 
a valuation in S. Then 


p, M : o & [M], € [ole 


(ii) Let p be a substitution and € be a valuation in S. Then 


BEET Sp,éEExv:o, foralla:ainT 


(iii) Finally, 
TEM :0 Yoi, E FT > p,€ EM : o] 


12.6.4. PROPOSITION (Soundness). 


Ti+} M:o3sTEM:0a 
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PROOF. Similar to the proof for the corresponding property of A—, i.e., 
by induction on the derivation of T F M : oa. There are two new cases 
corresponding to the V-rules. 

If the derivation ends in 


Tt M:Vao 
PF pot a=} 


then by the induction hypothesis 


TEM :Vao 


Now suppose p,€ =T, and we are to show that p, = M : o{a := T}. We 
have 


[M], € Na.c]e = () [olefa:=x} 
Xes 


Hence 
[M], € [olega:=pryey = Loto := THe. 
If the derivation ends in 


Tt M:oa 
T+ M:Vao 


where a is not free in I’, then by the induction hypothesis, 
TEM :o. 


Suppose p, =T, we are to show that p,€ = M :Va.c. Since a is not free 
in I, we have for all X € S that p, {a := X} HT. Therefore, 


[M]; € [oleta:=x} 


for all X € S. Hence also 
[M], € Wao] 


as required. O 


12.6.5. THEOREM (Strong normalization). IT F M : øo then M is strongly 
normalizing. 


PROOF. Similar to the corresponding proof for A—>. oO 


The above proof differs in a very substantial way from Tait’s strong 
normalization proof for simple types or for System T. The difference is that 
a formalization of this argument necessarily requires quantification over sets 
of sets of A-terms. 
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Indeed, let us compare the statement of Lemma 12.6.2 and Lemma 4.4.3 
part (iii). As we have noticed in Chapter 11, the latter requires quantifica- 
tion over sets X satisfying the definition of |o]. But then we could define 
a fixed set |o] for each o by induction. Because of impredicativity, such a 
definition of [a] would now become circular and we must consider various 
candidates |o] for the position of |o]. Each € gives a family of such candi- 
dates (sets), and the quantification over € in the statement of Lemma 12.6.2 
is equivalent to quantifications over these families. 

In other words, our proof cannot be formalized even in the second-order 
language of arithmetic. In fact, we can repeat Gödel’s argument and obtain 
a consistency proof for second-order Peano Arithmetic in this way. Thus, 
strong normalization for System F makes an example of a statement inde- 
pendent from second-order Peano Arithmetic. 

But as long as we are only interested in strong normalization of a set 
of terms involving only finitely many types, we can proceed within second- 
order arithmetic. Indeed, in this case, the functions € are of finite domains 
and can be handled as tuples of sets. Thus, if (an algorithm of) an integer 
function is definable in F, then its totality can be shown within second-order 
arithmetic. On the other hand, the Dialectica interpretation, generalized by 
Girard for System F, allows one to derive a definition in F for every function 
provably total in second-order arithmetic. We obtain the following result: 


12.6.6. THEOREM (Girard). The class of functions definable in F coincides 
with the class of provably recursive functions of second-order Peano Arith- 
metic. 


12.7. Exercises 


12.7.1. EXERCISE. Prove that Gabbay’s axiom holds in all Kripke models 
with constant domains, but not in all Kripke models. 


12.7.2. EXERCISE. Can you simplify the definition of forcing of universal 
formulas in models with constant domains? Hint: Yes, you can. 


12.7.3. EXERCISE. Show that in complete Kripke models, the semantics of 
the defined connectives (see Section 12.4) coincides with the semantics of 
their definitions. Does this hold in non-complete models? 


12.7.4. EXERCISE. Show that the type assignment rules for pairs and pro- 
jections are correct under Definition 12.4.2 and that 1;((P1, P2)) +g P;. 


12.7.5. EXERCISE. Show that the type assignment rules for injections and 
case elimination are correct under Definition 12.4.3 and that beta-reduction 
is properly implemented, i.e., 

case(inj(N%); x .M?; £} .M8) +¢ Mila; := N]. 
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12.7.6. EXERCISE. Consider the eta reduction rule for disjunction, and the 


commuting conversions of Definition 7.23. Are they correct with respect to 
Definition 12.4.3? 


12.7.7. EXERCISE. Define an interpretetion in System F for the types of: 
e words over a fixed finite alphabet; 
e finite binary trees; 
e lists over a type T, 

with the appropriate basic operations on these types. 


12.7.8. EXERCISE. Prove Proposition 12.4.4. Can you strenghten it by re- 
placing =g by —»g? 


12.7.9. EXERCISE. Show that the definitions of abstype and pack in Sys- 
tem F satisfy the beta reduction rule for existential types. 


12.7.10. EXERCISE. Consider a Curry-style calculus with existential types, 
analogous to the Curry-style calculus with first-order existential quantifica- 
tion, as in Section 10.5. Show that it does not have the subject reduction 


property. 
12.7.11. EXERCISE. Verify the correctness of Example 12.5.4. 


12.7.12. EXERCISE. Show that all terms in normal form are typable in Sys- 
tem F. 


12.7.13. EXERCISE. Show that (Ax. xx) (Az. zyz) is typable in System F. 


12.7.14. EXERCISE. Show an example of a pure lambda-term M, typable in 
System F, and such that M —, M’, for some untypable M'. Warning: An 
example known to the authors is the term 


Aa. [Ayz. a((Av. v(Axy. yay) jy) (zy) (z(Ax. cex))]Y Z, 


where Y is Av. K(xx)(xaa) and Z is Au. u(Ary.a). A verification takes 5 
handwritten pages. 


12.7.15. EXERCISE. Prove that (Av. xx)(Ax. xx) is untypable in System F, 
without using the fact that typable terms can be normalized. 


12.7.16. EXERCISE. Prove that the terms c2c2K and (Azy. y(zI)(zK)) (Az. xz) 
are untypable in System F. 


12.7.17. EXERCISE. Show that the polymorphic type assignment has no prin- 
cipal type property. (For instance show that Ax. xx has no principal type.) 


12.7.18. EXERCISE. Assume strong normalization for Curry-style System F. 
Derive strong normalization for Church-style System F. 


CHAPTER 13 


The -cube and pure type systems 


In this chapter we introduce Barendregt’s A-cube which can be seen as a 
generic typed A-calculus with eight instances. Among these are A—>, A2, 
and AP seen earlier. We also present the generalization to pure type systems 
which can be seen as a generic typed A-calculus with infinitely many typed 
A-calculi as instances—among these are the eight systems of the A-cube. 

We first present some motivation for the study of the A-cube and then 
proceed to the actual definitions. A number of examples are given to illus- 
trate various aspects of the A-cube. We then argue that the new presenta- 
tions of A etc. are equivalent to the previous presentations, although we 
do not settle this in all detail. 

After this, we introduce pure type systems, give a number of examples, 
and develop the most rudimentary theory of pure type systems. 

The presentation follows [8]. 


13.1. Introduction 


The previous chapters of the notes have presented several related typed A- 
calculi, e.g, the simply typed A-calculus A—, the system AP of dependent 
types, and the second-order typed A-calculus \2.! 

The simplest of the systems is clearly simply typed A-calculus; in this 
system one can have a term Axv:o . x of type o —> øg, in short 


FAGia.n%i:o70. 
Given a term M, we may form the new term Ax: a . M which expects a 


term as argument; in other words, the term Ax:o0 . M depends on a term. 
Thus, in A, terms may depend on terms. 


'In this chapter we are exclusively concerned with typed )-calculi à la Church. 
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In \2 one can have a term? Aa:*. Av:a. x of type Va.a — a, in short 
F Aarx.At:a.2:Vaa7a. 


Given a term M, we may form the new term Aa: *. M which expects a 
type o as argument; in other words, the term Aa: *. M depends on a type. 
Thus, in A2 terms may depend on types. 

Finally, in the system AP, we can have an expression Av: @ . œa expecting 
a term of type @ as argument and returning the type a as result. Such 
an expression is called a type constructor since it constructs a type when 
provided with suitable arguments. To describe the input and output of a 
term one uses types; a term has a certain type. Similarly, the input and 
output of constructors are described by kinds. For instance, if œ is a type, 
then Ax:a@.a@ has kind a — x, in short 


a:*kF ATIAa.Aa:Aa>*, 


expressing the fact that the constructor expects a term of type œ and con- 
structs a member of x, i.e., a type. If we apply this expression to a term of 
type a, then we get a type: 


a:*xy:ak (At:a.a)y:*. 


In conclusion, given a type a we may form the type constructor Av:a.a@ 
which expects a term of type a as argument; in other words, the type con- 
structor Ax:a@.a depends on a term. Thus, in AP types may depend on 
terms. 

There is one combination we have not mentioned: we have seen terms 
depending on terms, terms depending on types and types depending on 
terms—what about types depending on types? Can we have expressions 
like Aw: * . a — a? This would again be a type constructor, but where 
the argument is now a type rather than a term; such an expression would 
have kind « — x. In fact, a system exists in which such expressions may be 
formed, known as Aw. 

The three systems A2, AP, and Aw each arise from A— by adding an- 
other type of dependency than terms depending on terms; it is natural to 
study also the combination of these dependencies, and systems exist in which 
several dependencies are allowed, e.g., the system Aw in which both terms 
depending on types and types depending on types are allowed, and this will 
also be done below. 

Before proceeding with the details of such systems, it will be well worth 
our effort to reconsider the style or presentation from previous chapters. 
In all the -calculi presented in previous chapters, one or more forms of 


?The annotation “: x” was not written in the preceding chapter. The informal meaning 
of ø : x is that o is a type. 
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abstraction are present, and different rules govern the typing of the various 
forms of abstraction. For instance, in A2 we have both 


Tja:ot M:t 
TF At:ao.M:0>57 


and 
Tit M:7 


Tr F Aa: *.M :Va.r 


Similarly, we have several types of products, e.g. o — T and Va.o. 

It would be better if we could present the systems with a single notion of 
abstraction parametrized over the permitted dependencies. This is exactly 
what one does on the A-cube. 

This idea facilitates a more slick presentation of each of the systems 
in the A-cube, and also makes the connection between the various systems 
more transparent. Moreover, properties about the various systems can be 
developed once and for all by providing proofs that are parametric in the 
permitted dependencies: if we can prove, e.g., subject reduction regardless 
of which dependencies are permitted, then we do not have to prove the 
property for all the systems individually. 


13.2. Barendregt’s \-cube 


We introduce Barendregt’s \-cube following [8]. 


13.2.1. DEFINITION. 


(i) The set S of sorts is defined by S = {x,O}. We use s,s’, 81, S2, etc. to 
range over sorts. 


(ii) For each s € S, let V, denote a countably infinite set of variables such 
that Vs N Vy = @ when s Æ s’, and let V = Ues Vs. 


(iii) The set € of expressions is given by the abstract syntax: 
f= VS ECElAV UES | MY ee 


As before, we assume familiarity with the subexpression relation C, with 
the set FV(M) of free variables of M, and with substitution M{x := N} 
for x € Vand M,N € E. We write A > B for IId: A.B when d ¢ FV(B). 
We use = to denote syntactic identity modulo a-conversion and adopt 
the usual hygiene conventions. 


(iv) The relation —>g on E is the compatible closure of the rule 
(At:A.M)N 6 M{x:=N} 


Also, —> g and =g are the transitive, reflexive closure and the transitive, 
reflexive, symmetric closure of —g, respectively. 
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(v) The set C of contexts is the set of all sequences 


Cp Aies im An 


where £1,...,£n E V, A1,..., An E E, and z; # xj when i Æ j. 
The empty sequence is [], and the concatenation of [ and A is T, A. 
We write x: A € T if rT = 1y,2: A, I2, for some l1, T2, and we 
write T C A if, for every x: A € T, also x: A € A. For ec, 


dom(T) = {x |x:A €T, for some A}. 


(vi) For any set R C S x S of rules, the relation F C C x € x E is defined 
in Figure 13.1. fT F M: A, then T is legal and M, A are legal (in 
T). We use the notation F A: B: C meaning that + A: B and 


TF B:C. 
(axiom) ] F x 
[TF A:s 
(start) Tz: AF z:A if x E€ Vs & x g dom(T) 


PP ASB. TrTFC:s 
(weakening) Ee ALB 


Tt A:s TD x:AF B: 89 


Tt F:(eA.B) TPra:A 
(application) Pa? Bia = a} 


T,x:A F b:B_ T F (Mzx:A.B):s 


(abstraction) T F àz:A.b: Nes: B 


TKEA:B TH B':s 


(conversion) Pe ASE if B=, B’ 


if x E€ Vs & x g dom(L) 


(product) [+ (Mrz: A. B) : se if (s1,52) ER 


Figure 13.1: INFERENCE RULES OF THE A-CUBE 


(vii) The -cube consists of the eight -calculi obtained by taking the differ- 


ent sets of rules {(*,*)} C R C {(x,x), (0, *), (*, 
in the table in Figure 13.2. 


)( 


’ 


)} specified 
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A (Gets) 

A2 (*, *) | (2, *) 

Aw (*, *) ( , ) 

Aw = AwW2 (*, *) ( ) *) ( , ) 

AP (*,*) (x, o) 
AP2 (x,*) | (El) (x, O) 
APw (*, *) ( , ) (x, ) 
AC = APw | (x,x) | (Oye) | (2, 0) | (*, 0) 


Figure 13.2: RULES OF THE A-CUBE 


13.2.2. REMARK. The different rules in Figure 13.2 correspond to the de- 
pendencies mentioned earlier: 

(*,*): terms depending on terms 
terms depending on types 
types depending on terms 
types depending on types 


*, 


( 
(O,*): 
( 


$ 


na 
WS AN 


Informally speaking, terms may also depend on types in A—; for instance, 
At:a. x is a term depending on the type a. However, the crucial point 
is that we may not abstract over a in the term. In contract, this form of 
abstraction is permitted in A2. 


The A-cube is depicted diagrammatically in Figure 13.3. 


80 60 


pu IAP 


Figure 13.3: THE A-CUBE 
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13.3. Example derivations 


There are several subtle details in the previous definition. Some of these 
are illustrated in the following examples, taken from [8], which the reader is 
encouraged to work out in detail. 


13.3.1. EXAMPLE. In à> one can derive the following. 


1. 


T. 


a : xF Ia:a.a:x*. Being a member of x should be conceived as being 
a type, so if a is a type, then so is IIz:a. a. 


Here a is a variable from Vo (type variables) and z is another variable 
from V, (term variables). Hence x ¢ FV(a), so Iz: œ. a =a > a, 
using the abbreviation from Definition 13.2.1(iii). 


This means that we may form expressions that map terms of type a 
to terms of type a (terms may depend on terms). 


Note that the type variable œ must be declared in the context; the 
only typing in the empty context in this formulation of A— is F x: O! 


.œ&:xF Av: a@.a: IIx: a.a. Using the abbreviation from Defini- 


tion 13.2.1(iii), this means that we have a: x F Ar:a.u:a-a. 


Note that a: * F Av:a.a: IIx: a. a does not follow from the 
mere fact that a: *,2:a@ F x: a alone; we also have to show that 
a : x F Ix:a.a@: x, which can be derived using the fact that (*,*) E€ R. 


. aki 8:x,y: BF Az: . y: Iara. p. 


.a:x,y:aF (Az:a.xz)y:a. 


.a:*y:akry:a. We have 


(Az:a.xz)y >g vy. 


Note that typing is preserved under this particular reduction. 


.a:*x, B:x,z:a,y: BF (Az:a.y) x: B. Note how the weakening 


rule is required to establish this. 


a:*,B:*xF Aria. dAy:B.y:a>Broa:*. 


13.3.2. EXAMPLE. In A2 one can derive the following. 


1. 


2. 


a:xF àz:a.x:a— a, just like in à>. 


F àa:x*. Axia. x: Hax. a a: *. 


To understand the relationship with the previous formulation of A2, 
the reader should realize that Ila: x. ø is just a new way of writing 
Va.c and that Aa:* . M is just a new way of writing Aa: x. M. 
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This means that we may form expressions that map any type a toa 
term of type a — a (terms may depend on types). 

The reader may be worried about the absence of the side condition 
“where a is not free in the context” in the abstraction rule for second- 
order generalization. How can we be sure that we do not move from 
a:*,2:abtF M:otox:a F Aa:*x.M: Ia: x.o, where we 
generalize over a variable which is free in the context? Interestingly, 
this is ensured by the fact that contexts are sequences and that we 
may discharge the rightmost assumption only. 


This also shows why the weakening rule is necessary: without weaken- 
ing, we could not derive something as elementary as@:*,u:a@bFa: x. 


3. B: xF (Aa:*.Ar:a.2) Bb: B>B. 
4. B:x,y: BE (Aa:* . Az:a. x) By: B. We have 
Qa:t.At:a.z)By —ş (At:B.z)y >s y 
and each of these terms has type £. 


5. Let L =Ta:*.a. Then F (AG:*.Av:L.a 8): TG:*.1 — 8. Via the 
Curry-Howard isomorphism this type is a proposition in second-order 
propositional logic which states that everything follows from absurdity; 
the term is the constructive proof of the proposition. 


13.3.3. EXAMPLE. Let D = AG: *« . 86 — B. In Aw one can derive the 
following. 


1. F x — x: O. Being a member of O should be conceived as being a 
kind, so x > x is a kind. 


This means that we may form expressions that map types to types 
(types may depend on types). 


2. Dix x. 

3.a:xF Da:x. 

4. ee PDI a) 26 

5. a: xb Ag:(Da).2:(Da)— (Da). 


6. a:*F Av:(Da).x: D (Da). Note how the conversion rule is used 
to derive this. We have 


(D a) > (D a) =g D (Da) 


and the conversion rule allows us to exchange the first type with the 
second. 
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13.3.4. EXAMPLE. In AP one can derive the following. 


l. &a:xFa—*: 


This means that we may form expressions that map a term of type a 
to a type (types may depend on terms). 


If we view q@ as a set and * as the universe of propositions, then a 
member of a — x is a map from a to propositions, i.e., a predicate 
on q. 


2,.@:%*,p:a>x*,xv:atpa:x. Again, if we view a as a set, pasa 
predicate on a, and x as an element of a, then p x is a proposition. 


3. a:x, p:a —> a -—> xF ra pre: x. 


If a is a set and p is a binary predicate on a, then Iz: aœ. pgx zx is a 
proposition. 


4. a:x, p:a —> x*,q:a — xF Ilzr:&a.px— qz: x. This proposition 
states that every member of œ which satisfies p also satisfies q. 


5. a:x,p:Q@—> xF Aàz:a.Az:p z.z: Hra. pgr —> prir. 


6. a: x, £0: &,p:&—*,q:*F 
àz: (Ilz:a. p x > q) . Ay: (IIz:a. p x) . (x ao) (y ao) : 
(IIz:a.p x > q) > (Iz: a. p z) > q. 


This proposition states that in every non-empty set A, 


(VE A:Pxr—>Q)—>(YrEeA:Pr)>Q. 


13.3.5. EXAMPLE. In Aw, the following can be derived. 


1. Let a&b = Ty: *. (a > 8 —> y) —> y. Then a: *,8:* F a&B: x. 
This is can also be derived in A2; it is the second-order definition of 
conjunction. 


2. Let AND = Aa: * . AGB: * . a&b. Then F AND: x > * — x and 
F ANDa@: *. Thus, AND is a uniform definition of conjunction over 
all types—this cannot be done in A2. 


3. Let m; = AaQ1:* . Aag:* . A£1:01 . AL2:@2 . xi. Then 
F m; : Hai: x. Wag: x. a, > ag > Qi. 
Also, 


a:*,8:*F Av: ANDaB.ra(maZB): ANDaB-a. 
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13.3.6. EXAMPLE. In AP2 the following can be derived. 


l.a:*,p:a>*F Ar:a.px— L:a-— x Here the construction of L 
requires A2 and the construction of expressions a — * requires AP. 


2. a:%*,p:a—->axt (IIz:a. ly:a.pry - pyr 1) —> Hza. pzz —> 
L : x. This proposition states that an asymmetric binary relation is 
irreflexive. 


13.3.7. EXAMPLE. In APw the following can be derived. 


1. a: xF p:a >a -—x*.Az:a. prr: (a a -> *)— (a> x). 
This constructor maps any predicate to its own “diagonalization.” 


Here the presence of x to the left and right of — requires Aw, and the 
construction of œ — * requires AP. 


2. F àa:x . Ap:a > a —> *. Av a. pra: Tla:*.(a — a —> *) > (a> x). 
This constructor does the same uniformly in a. 


13.3.8. EXAMPLE. In AC the following can be derived. 


1. AXa:*.Ap:a> L. Ar:a.px— 1: Tax. (a — *) — (a — *). This 
constructor maps a type a and a predicate p on a to the negation of p. 


Here the presence of x on both sides of — requires Aw, and A — * 
requires AP, and Ila: x. ... requires A2. 


13.4. Classification and equivalence with previous formula- 
tions 


The above presentation of A— etc. has several advantages, as mentioned 
above. However, the presentation also has the disadvantage that in the case 
of some of the simple systems (e.g. A) the presentation involves a certain 
amount of redundancy. For instance, in case of A—> the product IIx: A. B 
mentioned in the product rule always has form A — B. Also, the distinction 
between terms, types, and kinds, which is abandoned in the cube is, after 
all, useful for understanding the details of the various systems. 

In this section we therefore try to recover some of what has been lost by 
showing that—to a certain extent—the traditional formulations of some of 
the systems in the A-cube are equivalent with the formulations in terms of 
the A-cube. More about this can be found in [12, 8, 41]. 

Below we show how terms belonging to systems in the A-cube can be 
classified according to the notions of object, constructors, and kinds. 
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13.4.1. DEFINITION. Define the sets O,7,K of objects, constructors, and 


kinds as follows: 


O i= VW [AV : T. O0O|OO|AVa:K.O|OT 
T = V |AVn:T .T|TO|AVa:K.T |T T |IVT.T | Wak. T 
= IVeT.K|HIVo:K.K |x 


Reading objects as terms, constructors as types, and kinds as—well— 
kinds, this crystalizes the four forms of dependencies between terms and 
types expressed by the four forms of abstractions, or the four forms of prod- 


ucts. 


The following selects among the above expressions those that are legal. 
In the definition and the following proposition, H refers to AC. 


13.4.2. DEFINITION. Define the sets O+, T+, Kt as follows: 


ot 
T+ 
Kt 


{O€O|ar,A.T + O: A} 
{TeT|a,ATET: A} 
{KeK|ar.0+ K:0} 


13.4.3. PROPOSITION (Classification of the A-cube). 


1. The sets O*,T*,K* and {0} are pairwise disjoint and closed under 


reduction. 


2. T + A: B then exactly one of the following holds: 


e (A,B) €O 


xT 


» Or 


e (A,B) € Tt x Kr, or 


e (A, B)EK 


x { 


} 


One obtains similar classifications for particular systems within the A-cube: 


1. For \—,A2,Aw, and Aw omit the clauses AV* : JT . 7, TJ O, and 


HV*: T.K; 


2. For A—,à2,AP2, and AP omit the clauses AV- :K . T, T T, and 


HIV-: K.K; 


3. For A—>,àw,APw, and AP omit the clauses AV- : K . ©, O T, and 


IV: K.T. 


One can use this to show, e.g., that in A—> products Iz: œ. 8 in fact always 
have form a —> £, i.e., x Z FV(a). 
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13.5. Pure type systems 


In this subsection we introduce pure type systems, as presented by Baren- 
dregt, Geuvers, and Nederhof [8, 42, 41]. The main ideas in the step from 
the A-cube to pure type systems are the following: 


1. One takes a set S as the set of sorts rather than just {x, O}. 


2. One takes a relation A C S x S as the set of axioms rather than the 
single axiom (* : 0O). 


3. One takes a relation R C S x Sx S as the set of rules rather than the 
specific sets of rules from Figure 13.2. 


4. The product rule is generalized so that products need not live in the 
same universe as their range. That is, A — B does not necessarily live 
in the same sort as B.’ 


13.5.1. DEFINITION. A pure type system (PTS) is a triple (S,A,R) where 


(i) S is a set of sorts; 
(ii) ACS x S isa set of axioms; 
(iii) RC S x Sx S isa set of rules. 
We write (s,s’) E R for (s, 5’, s) ER. 
13.5.2. DEFINITION. Let (S, A, R) be a PTS. 


(i) For each s € S, let V, denote a countably infinite set of variables such 
that Vs N Vy = Ø when s Æ s’, and let V = Ues Vs. 


(ii) The set € of expressions is given by the abstract syntax: 
E=V|S|EEJAV:EE|IV: E.E 


We assume familiarity with the subexpression relation C, with the set 
FV(M) of free variables of M, and with substitution M{x := N} for 
x € V and M,N € E. We write A — B for Id: A. B when d ¢ FV(B). 
We use = to denote syntactic identity modulo a-conversion and adopt 
the usual hygiene conventions—see [7]. 


(iii) The relation +g on € is smallest compatible relation satisfying 
(At:A.M)N => M{z:=N} 


Also, —> g and =g are the transitive, reflexive closure and the transitive, 
reflexive, symmetric closure of —g, respectively. 


3Notice the difference in the side condition in the product rule in the -cube and the 
product rule in pure type systems (see below): in the latter case we also have to specify 
s3—the sort in which the product is to live. 
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(iv) The set C of contexts is the set of all sequences 
Die Agen, be CAL, 


where ayia E€ V, A1,..., An E E, and z; Æ xj when i Æ j. 
The empty sequence is [], and the concatenation of I and A is T, A. 
We write x: A € T ifr = 1,2: A, I2, for some l1, l'2, and we 
write T C A if, for every x: A € T, also x: A € A. For ec, 
dom(T) = {x |x:A €T, for some A}. 


The relation H C C x € x € is defined in Figure 13.4. If [ | M : A, then 
T is legal and M, A are legal (in T). We use the notation TF A: B:C 
meaning that T F A: BandI + B:C. 


— 
= 


(axiom) [| F sı: s2 if (51,52) EA 
TF A:s 
(start) TA A if x € Vs & x g dom(L) 


THA:B THEC:s 
B 


(weakening) DeC FA: if x E€ Vs & « g dom(T) 


Tt A:sy T,2:At B: 89 
(product) [+ (Ia: A. B) : s3 if (s1, 52,53) ER 


Tt F:(eA.B) Tra:A 
(application) T F Fa: B{z:=a} 


Pics be T F (Izx:A.B):s 
(abstraction) T F àz:A.b: Iz A. B 


rTHA:B rH BP:s 
(conversion) rH A: B if B =; B' 


Figure 13.4: PURE TYPE SYSTEMS 


13.5.3. CONVENTION. To save notation we often consider in the remainder a 
PTS AS and say, e.g., that s € Sor M €E E with the understanding that AS = 
(S, A,R) and that V, €, C, +g and F are defined as in Definition 13.5.2. 
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13.6. Examples of pure type systems 

13.6.1. EXAMPLE. The A-cube consists of the eight PTSs AS, where 
(i) S = {*,O}; 
(ii) A= {(*, 0)}; 

(ili) {(+, *)} © R C {(*, *), (0, *), (*, 0), (0, 0)}. 


The following systems extend Aw with sort A, axiom O : A, and some 
rules for the new sort. The system AHOL is defined by: 


(i) S = {*,O, A}; 

(ii) A= {(*, 0), (0, A)}; 

(iii) R = {(*, »), (0, »), (0, 0)}. 
The system AU~ is defined by: 


(i) S = {*,O, A}; 

(ii) A= {(*,0),(O,4)}; 

(ili) R = {(*, *), (0, *), (0, 0), (A, O)}- 
The system AU is defined by: 


(i) S= {x, ’ i 
(ii) A= {(*, )( WAY |e 
(ili) R = {(*,*),(G,*),(G, 0), (A, *), (A, O)}- 
13.6.2. EXAMPLE. The system Ax is defined by: 
(i) S = {*}; 
(ii) A= {(*,*)}; 
(iii) R = {(«, *)}. 


We end this section with an example of a somewhat different pure type 
system. 


13.6.3. EXAMPLE. The system APRED is defined by: 


(i) S= {*°, xP, af, a P}; 
(ii) A= {(*°, DR (P, P)}; 
(iii) R = { (4P, xP), (x5, xP), (x8, OP), (49, x8, xf), (x8, xf, xf )}. 


This is another formulation of predicate logic as a PTS (other than AP). 
The significance of the sorts is as follows. 
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1. The sort x° is for sets. 
2. The sort *? is for propositions. 
3. The sort */ is for first-order functions from sets to sets. 
4. The sorts O° and OP contain ** and *? respectively. There is no 


sort Of. This means that we cannot have variables ranging over func- 


tion spaces. 


The significance of the rules is as follows. 


1. The rule (*?, x”) allows the formation of implication between proposi- 


tions. 
pix p: P HF poy [= r: go. y *? 


. The rule (**, xP) allows quantification over sets. 


a: x5, g: xP Ve Eag = Iara. g : x” 


. The rule (**, OP) allows the formation of first-order predicates. 


P 


a: x? F a — x? = Ira. x : 


so 
Oe p:a >P, era pase. 


. The rule (*°, *°,*/) allows the formation of function spaces between 


sets. 
a: Bix bas Be xl, 


. The rule (**,*/,*/) allows the formation of curried multi-argument 


function spaces between sets. 


a:* ba (asa): +. 


13.7. Properties of pure type systems 


As mentioned in the introduction, one of the reasons for introducing the 
A-cube is the desire to facilitate proofs which apply to a number of systems 
at the same time. For instance, it is better to prove the subject reduction 
property in a generic way which applies to all the systems in the A-cube, 
regardless of the particular set R of rules, than it is to prove the property 
for each system individually. 


This idea is even more compelling in the case of pure type systems: 


having shown that a property holds for all pure type systems we know 
not only that the property holds for all the systems of the A-cube, but 
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also for infinitely many other systems, a number of which have appeared 
independently in the literature. 

In this section we develop the most rudimentary theory of pure type 
systems. Throughout the section, AS denotes an arbitrary pure type system. 


13.7.1. LEMMA (Properties of substitution). 
1. A{z:= B}{y := C} = A{y := CHa := Bly := CH}, if y g FV(B); 
2. B = C => A{zx := B} =g A{z := C}; 


3. A=6 B & C = D > A{z := C} =g Bix := D}. 


PROOF. (1)-(2): By induction on A. (3): By induction on A =g B, using 
(1)-(2). o 


13.7.2. PROPOSITION (Church-Rosser). The relation >g on E is confluent. 


PROOF. By the technique of Tait and Martin-Löf—see e.g. [8]. O 
13.7.3. LEMMA (Free variables). If 71: A1,...,%n:An F B:C then: 

1. %1,...,Xn are distinct; 

2. EV(B) UPN (G) C {21,... En}; 


3. ENA) C {21,... £i} JOR SS Ce 


PROOF. By induction on the derivation of x1: A1,... ,£¥n:An F B:C. O 
13.7.4. LEMMA (Start). IfT is legal then: 

1. (81,82) EA >T 81: 89; 

2 x: AcrsT TF Fz:A. 


PROOF. Since T is legal T F B : C for some B,C. Proceed by induction 
on the derivation of T F B: C. oO 


13.7.5. LEMMA (Transitivity). Let A be legal. If x1: A1... ,£n:An F A: B 
and A F xi: A; fori=1,...,n then A F A: B. 


PROOF. By induction on the derivation of xı : Aj,...,%,:A4, F A: B 
making use of the start lemma. O 


13.7.6. LEMMA (Substitution). IfT,x:A,A + B:C andr | a: A, then* 
T,A{x :=a} F A{z := a} Ble = a}. 


‘Substitution (and any other map) is extended from expressions to contexts in the 
usual way. 


224 Chapter 13. The A-cube and pure type systems 


PROOF. By induction on the derivation of [,2:A,A F B : C using the free 
variables lemma and properties of substitution. oO 


13.7.7. LEMMA (Thinning). JT F A: B, A is legal, and every (x: A) in T 
is also in A, then A + A:B. 


ProoF. This follows from the start lemma and the transitivity lemma. O 


13.7.8. LEMMA (Generation). Suppose that T F M: C. 


1. M =s > J(s, s) € A. C =g 3' 


2. M=zr > IDEE. C= Dk&axzDET. 


3. M = àz. Ab > JsES, B € E. C =g Ilx: A.B & Te:Arb:B&reb 
Ir: A. B:s. 


4. M = Ilx: A.B > 4(s1,8s2,83) E R. C=g 53 KT F A:sı&r,z: 
AF B:s. 


5. M = Fa > 3rEeV, A,B € E. C = B{x :=a} & Tr F F: Ie: 
AB&Tra:A. 


PROOF. By induction on the derivation of fT  M:C. oO 


13.7.9. LEMMA (Correctness of types). Jf[ F A: B then either B € S or 
dse€S.0TF B:s. 


ProoFr. By induction on T F A: B, using the generation and substitution 
lemmas. O 


13.7.10. THEOREM (Subject reduction). IT H A: B and A >g A’ then 
rH A, 


PROOF. Prove by simultaneous induction on the derivation of T F A: B: 


1. iff | A: Band Ag, A’ thenT F A’: B; 


2. ifr F A: B andT —gI’ then I’ + A: B. 


The proof uses the substitution lemma. oO 
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13.8. The Barendregt-Geuvers-Klop conjecture 
The following terminology should be well-known by now. 
13.8.1. DEFINITION. Let AS be a PTS. A G-reduction path from an expres- 


sion Mp is a (possibly infinite) sequence Mp >g Mı >g M2 —>g ... If the 
sequence is finite, it ends in the last expression Mp» and has length n. 


13.8.2. DEFINITION. Let AS be a PTS, and M an expression. 
(i 
(ii 


(iii 


M € og & there is an infinite -reduction path from M; 
M € NFg & there is no -reduction path of length 1 or more from M; 
M €SNg & all -reduction paths from M are finite; 


SH a RS eS 


(iv) M € WNg & there is a -reduction from M ending in N € NFg. 
Elements of NFg,5Ng, WNg are -normal forms, 3-strongly normalizing, and 


B-weakly normalizing, respectively. We also write, e.g., cog(M) for M € cog. 


13.8.3. DEFINITION. AS is weakly normalizing if all legal expressions are 
weakly normalizing, and strongly normalizing if all legal expressions are 
strongly normalizing. In this case we write AS H WNg and AS |} SNg, 
respectively. 


13.8.4. EXAMPLE. All the systems of the A-cube are strongly normalizing— 
see, e.g., [12, 8, 42, 41]. The system Ax is the simplest PTS which is not 
strongly normalizing. The system AU is is a natural extension of Aw which, 
surprisingly, is not strongly normalizing. This result shows that, apparently, 
the fact that x fails to be strongly normalizing is not merely a consequence 
of the cyclicity in its axiom (x, *). 


We conclude the notes by mentioning an open problem in the field—for 
more on the problem see [101]. 


13.8.5. CONJECTURE (Barendregt, Geuvers, Klop). For every PTS XS: 


AS = WNg AS H SNg 
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CHAPTER 14 


Solutions and hints to selected exercises 


Some of the solutions below are based on actual homework done in ATEX by 
Henning Niss (1.7.7) and Henning Makholm (6.8.20 and 6.8.21). In one of 
his homeworks, Henning Makholm has solved an apparently open problem 
(Exercise 6.8.3). 


Exercise 1.7.7 
14.0.6. LEMMA (Substitution Lemma). If x 4 y and x g FV(L) then 


M{x := ON fy := L} = M{y := Be := N{y := L} 


PROOF. By induction on M. 
Case M = x. Since x Æ y: 


M{x := Nyy := L} = ate := NġHy := L} 
= N{y := L} 
= af = Nfy = L}) 
= ay = L}{x := N{y := L}} 
= M{y := L}{x := N{y := L}} 


The remaining cases are shown in less detail. 
Case M = y. Since x ¢ FV(L): 


Mig := NMG := L} = L 
Mig = LHe : 


N{y := L}} 
Case M = z where z Æ x and z Æ y. Then: 


M{x := Nyy := L} = z 
= M{y := L}{x := N{y := L}} 


Case M = Az.P. Without loss of generality we may assume z Æ x and 
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z # y. Then by the induction hypothesis: 
Mis NyHy := L} = Aàz.P{x := NHy := L} 


= Az.P{y := LHe := N{y := L} 
= M{y := LHe = N{y := L}} 


Case M = P Q. Similar to the preceding case. oO 


The following states that — g is compatible. 


14.0.7. LEMMA. Assume that P,P’ € A are such that P —»g P'. Then, for 
alla € V andall QEA: 


(i) àz.P >g àx.P'; 
(ii) P Q >p P' Q; 
(iii) Q P >s QP’. 


PROOF. (i): By induction on the derivation of P =g P’. 
Case P —»3 P’ because P +g P. Then \x.P 3 Ax.P’. Therefore 
also Ax.P —»g Ax.P’. 
Case P —»g3 P’ because P —»g P” and P” —»g3 P. By the induction 
hypothesis, Ax.P —»g Ax.P” and Ax.P” —» 3 rx.P', so Ax.P —>g Ax.P'. 
Case P —»g P’ because P = P’. Then Ax.P = Ax.P’. Therefore also 
Ax.P ERB Aàx.P'. 
(ii)-(iii): induction on the definition of P +», P' O 


14.0.8. LEMMA. For all P, P’,Q €A, if 
P 8 P' 


then also 


Ple = Q} >s P'{x := Q}. 


ProoF. By induction on the derivation of P — 3 P’. The interesting case 
is P = (Ay.Pi\) Qı >g Pity = Qı} =P’. We have 


(Ay.Pi) Qi){z := Q} = Oy-Pi{x := Q}) (Qi{x := Q} 
>; Pi{x := QHy := Qi{x := Q}} 
= Pity = Qi}{z := Q}, 


where the last equality follows from the Substitution Lemma (since y is not 
free in Q). oO 
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14.0.9. LEMMA. For all P,Q,Q’ € A, if 
Q >s Q 
then also 
Pie := Q} >g P{x := Q}. 
ProoF. By induction on the structure of P. 
Case P = z, then P{z := Q} = Q >s Q' = P{z := Q'}. 
Case P = y, then P{z := Q} =y—g y = P{z := Q'}. 
Case P = Xy.P’, then 
OAy.P Hz := Q} = dy.P{zx := Q} 
—»g dAy.P'{x := Q} 
= (y.P'){r = Q'} 
where — follows from the induction hypothesis and compatibility of —> g. 
Case P = P) Po, then 
(Pi Poix = Q} = (Piiz := Q}) (Pafx := Q}) 
—>g (Pi{x := Q'}) (Pafe := Q}) 
—>g (Pi{z := Q'}) (Pie := Q'}) 
= (Pi Pox = Q} 
where both — g-steps follow from the induction hypothesis and compatibility 
of—> g. O 


Now the proposition in the exercise (1.72) can be proved. 


14.0.10. PROPOSITION (Weak Church-Rosser). For all Mı, M2, M3 € A, if 
Mı —g Mz and Mı —g Ms, then there exists an M4 € A such that 
Mo — B Ma4 and M3 — B Mg. 


PROOF. By induction on the derivation of Mı —g Mp. 

Case Mı = (Az.P) Q and My = P{x := Q}. Then either (1) M3 = 
(Az.P’) Q for P’ such that P >g P’, (2) M3 = (Az.P) Q' for Q’ such that 
Q >s Q’, or M3 = Mo. In the last case we are done. In situation (1) 
we have M3 = (Ax.P’)Q -, P'{x := Q} and Mz = P{x := Q} >g 
P'{x := Q} by Lemma 14.0.8, i.e., My = P'{x := Q}. Situation (2) is 
similar using Lemma 14.0.9. 


(1) (2) 
(Ax.P) (Ax.P) 
yo N ye ie 
P{x := Q} Az.P)Q Pi{x := Q} (Ax.P) Q! 
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Case Mı = \x.P and Mz = \x.P’ because P —g P’. Then M3 must 
be Azx.Q for Q € A such that P —g Q. By the induction hypothesis there 
is a term M’ such that P’ -»3 M’ and Q —»g M’. Then since —»g is 
compatible we have Mə = Ax.P’ >g rx.M' and M3 = àz.Q —>g Azr.M', 
and M4 = Ax.M’ is the sought term. 


“a 


ØøØ 
Ax. R AT.Q 


Ax.M! 
Case Mı = P Q and M = P’ Q because P —, P’. Then 

(1) M3 = P" Q for P” € A such that P —g P", or 

(2) M3 = P Q' for Q’ € A such that Q > Q. 
In the former case by the induction hypothesis we obtain an M’ such that 
P' —»g M' and P” —»3 M’ and thus (again by compatibility of —> g) that 
Mo =p Q — B M' Q and M3 =p" Q — B M' Q, ie: Ma4 = M' Q. In the 
latter case we have that Mz = P' Q >s P'Q' and Ma =PQ! -, P' Q 
(also by compatibility) and consequently M4 = P Q’ as desired. 


1 (2) 
PQ PQ 
fin = 
2 ICE j BA 
P' Q P" Q P' Q P Q 
M' Q P' Q' —— P' Q' 
This completes the proof. oO 


The proof does not extend directly to the full Church-Rosser property. 

Let us say that a relation — on a set S is weakly confluent if, whenever 
Sı — s2 and sı — s3, there is an s4 such that sg > ... > s4 and s3 >... 
s4. Let us call — confluent if, whenever sı > ... —> sg and sı > ... > $3, 
there is an s4 such that s2 — ... > s4 and s3 >... — 84. 

There are relations that are weakly confluent and not confluent. The 
simplest example is when we have a four-element set S = {51, $2, 53, S4} 
Sı — 82, and S2 —> 83, S2 — 83, and s3 —> s4: 


Sı 00 _ sy 00 — /b3 Nhs 


A relation — on a set S is strongly normalizing if there are no infinite 
reduction sequences 
SI 89° 
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of (not necessarily distinct) elements from S. Can you find a weakly conflu- 
ent, strongly normalizing relation that is not confluent? 


A diggression 


How many details should a proof contain? Everybody should do a proof in 
the style of Lemma 14.0.6 (induction on M € A) and a proof in the style of 
Lemma 14.0.7 (induction on the definition of P —»g P’) in every detail at 
least once in their life. 

However, having tried this, one can see that many details are completely 
mechanical. In choosing a level of detail in a proof, one should leave out de- 
tails that can be reconstructed mechanically with little effort by the reader. 
In contrast, steps that require good ideas, even small good ideas, should 
usually not be left out. 

Thus, a complete proof of Lemma 14.0.6 would be “Induction on M” and 
a complete proof of Lemma 14.0.7 would read “Induction on the definition 
of P -»g P’.” A complete proof of Lemma 14.0.8 might be “Induction on 
the definition of P —, P’,” but since something interesting happens in the 
case where P = (Ay.Pi) Qı >g Pify := Qi} = P’, one can also present 
that case and refer to the substitution lemma. 

If several cases in a proof are similar, but non-trivial, one can do the 
first example in detail and omit the remaining ones. 


Exercise 1.7.17 


14.0.11. PROPOSITION (Klop). Let A7122...%n.M be an abbreviation for the 
A-term At,.ALQ....ALn.-M. Let 


? Aabcde f ghijklmnopqstuvwayzr.r (thisisa fixedpointcombinator ) 
$ = ?????????????????????????? 


Then $ is a fixed point combinator, i.e., for any F € A: $ F =g F ($ F). 


PROOF. We have: 


$F = ?????????????????????????? F 


= (Aabcdefghijklmnopqstuvwzyzr. 
r (thisisa fixedpointcombinator)) 


= F($F) 


as required. oO 
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Exercise 2.7.2 


We only show the closure under weakening. The proof is by induction with 
respect to the size of the proof of T F y. We proceed by cases depending 
on the last rule used in this proof. Recall that the notation T, stands for 
T U{4}, whether or not y € F. That’s why e.g., Case 3 below works. 


Case 1: The proof consists only of a single application of an axiom scheme, 
that is y is an element of I. Then T, Y g is also an axiom. 


Case 2: The proof ends with an application of (AI). That is, y has the 
form yı A Y2 and we have proven I F y; and I F go. The proofs of 
these judgements are contained in the proof of IT F p, so we can apply the 
induction hypothesis to obtain T, Y F yı and T,y ye. By an application 
of (AI) we can derive T, Y F v1 A Yo. 


Case 3: The proof ends with an application of (VE). That is, we have 
T F 0i V 62, for some formulas 01, 62, such that T, 01 F y and T, 62 F Q. 
These proofs are all shorter, thus we can apply the induction hypothesis to 
obtain T,w F 01 V 02 and T, 01, Y F y and T, 02,% F wy. It remains to use 
rule (VE). 


Other cases are similar. 


Exercise 2.7.3 


1) Begin with the axiom 1+ L. Apply (LE), to derive L + y and (—>I) 
to derive F L —> y. 


3) Begin with p,p —> L F p and p,p > L F p —> L. Apply (>E) to get 
p,p — LF L, then twice (>I) to get F p > (p > L) > L. 
5) First show that ~—=~p, ~p, p F L (unfold the -’s). Thus, ~——~p, p H 


ap > L, i.e., ———np,p F ——p. But ——np = —7p —> L and one can 
derive —77p,p' L. It remains to use (I). 


7) First show that p > q,q —> L,p' L. Then apply (>I) three times. 


9) What we need is =pV-q, p^q F L. With help of (AE), derive separately 
~p V ~q, =p,p^q F L and =p V 7q,7q,p\qt L. Apply (VE) to these 
two judgements. 


11) Remember that + abbreviates a conjunction, so (AI) will be the last 
rule. One part of this proof uses (AE), the other one uses (AI). 


13) First derive (pV =p) > L, p F L, using rules (VE) and (>E). By (>I) 
obtain (p V =p) > L 7p. Then use (VE) and (—E) again to derive 
GNA kel 
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Exercise 2.7.4 


e First we show that a Ua = a, that is a < a holds for all a. This is 
because a = 0Ua = (—aNa)Ua = (—aUa)N (aUa) = 1N (aUa) = aUa. 


e The relation < is transitive because a U b = b and b U c = c implies 
that c= bUc= (aUb)Uc=aU(bUc)=aUc. 


e The antisymmetry (a < band b < a implies a = b) follows immediately 
from the definition. To see that a U b is the lub of a and b, assume 
that a < cand b < c. Then (aUb)Uc=aU(bUc)=aUc= c, ie, 
aUb<c. 


e The condition a Nb < a (that is (a N b) Ua = a) is shown as follows: 
(aNb)Ua = (aNb)U(aN1)= (aNb)U (aN (bU -—b)) = (anb)U(an 
b) U (aN —b) = (aN b) U (a N —b) =a N (bU —b) =a N1 =a. 


e IfaNb= a then b= (aNb) Ub = a Ub, i.e., a < b. On the other hand, 
ifa < b then (aN b) Ua = (aUa) N (bUa) = anb, and thus a < anb. 
We conclude a = a N b, by the previous item and antisymmetry. 


Exercise 2.7.5 


e The proof that the relation < is a partial order, and that U is the lub, 
is similar as for Exercise 2.7.4. 


e Next we show that —aNa = 0. We have —a < —a, i.e., a > 0 <a =>0. 
Thus, a N (a = 0) < 0, and since 0 is obviously the least element, we 
have aN —a =a N (a => 0) = 0. 


e Now we prove (a U b) Na = a, in a similar way as we proved the dual 
law (a Nb) Ua = a for a Boolean algebra. (Note that now we use 
bN —b = 0 instead of b U —b = 1.) 


e We derive (aM b) Ua = a from the above, because (a N b) Ua = 
(aUa) N (bUa) = aN (bUa). Note that we obtain here the idempotency 
of N, since aNa=aN(aUa)=ana. 


e Then we proceed in a similar way as for Boolean algebra. 


Exercise 2.7.6 


The only property which is not immediate is the equivalence between AM 
C C Band C C Int(—AU B). First note that the condition AN C C B 
is equivalent to C C —A U B, for all A, B and C. For the left-to-right 
implication observe that X C Y implies X C Int(Y), whenever X is an 
open set. The converse follows from Int(—A U B) C -AU B. 
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Exercise 2.7.8 (1)=(2) 


Let T = {,...,0n}, and let v be a valuation in a Heyting algebra H. 
We write v(T) to denote v(91) N --- N vu(n). By induction with respect to 
derivations we prove the following statement: “If T F y then v(T) < v(y), 
for all valuations in arbitrary Heyting algebras”. The hypothesis follows 
from the special case when v(T) = 1. 

For instance, consider the case of (I). To show v(T) < v(y — w) 
recall that v(p — w) = v(y) => v(w) and use the induction hypothesis 
v(T) Nv(y) < v(w). For the case of (VE) use the distributivity law. 


Exercise 2.7.9 


First we consider counterexamples with open sets. In what follows we use 
the convention that v(p) = P, v(q) = Q, etc, and we write ~ A for Int(—A). 


4) Take P to be the whole R? without one point. Then ~ P is empty 
and ~~ P is the full set R?. Thus ~~ P > P £1. 


6) Let P be an open disk, and Q be R? without one straight line crossing 
the middle of the disk. Then P = Q is the whole space without the 


intersection of the disk and the line. The value of the right-hand side 
is the whole space. 


8) Take the interiors of two complementary halves of R?. 
10) Take Q and R to be the half of R? where x < 0, and take P = 
R? — {(0,0)}. Then (P > Q)N (Q = P) is equal to Q and R. Thus 
the value of (p = q) e r is R? Z P. 


12) Take both P and Q to be the same open disk. 


Here are counterexamples in Kripke models. 
4) A two-element model with c < c’, where cK p and e IF p. 
6) A two-element model with c < c', where c, c IF pand œ IF qandcl¥ q. 


8) A three-element model with c < c', c”, where c' IF p, œ” IF q and noth- 
ing more happens. 


10) A three-element model with c < c’ < c’, where c IF p, c” IF p,q, r and 
nothing more happens. 


12) A two-element model with c < c', where c’ |F p,q and c forces nothing. 
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Exercise 2.7.10 


Use n lines beginning in (0,0) to divide the space R? into n disjoint angles 
and take their interiors as values of p;. The point (0,0) does not belong 
to the interpretation of this formula. Or take a Kripke model with all sets 
{c > co : clk pi} different. Then co does not force our formula. 


Exercise 2.7.11 


Let F be maximal and let aUb € F, but a,b g F. We show that either 
F U {a} or F U {b} can be extended to a proper filter. First assume that 
there are fi, fo E€ F such that fiNa= foNb=0. Then (f1N fo) MN (aUb) = 
(fin fona) U(fiN f2 Nb) =0U0 = 0, a contradiction. Thus either such 
fi or such fə does not exist. Assume for instance that f Ma Æ 0, for all 
f € F. Then the set Fa = {x: x > f Na for some f € F} is a proper filter 
extending F. 

Let F be a prime filter in a Boolean algebra, and assume that F C F”, 
with a € F’— F. Since a U —a = 1 € F and F is prime, we have —a € F 
and 0 = a N —a € F', a contradiction. 


Exercise 2.7.12 


The argument is similar to the first part of Exercise 2.7.11. Assume that G 
is our maximal element, and that cU d € G, but c,d Z G. The assumption 
of g1, g2 € G with gı Na < b and g2 Na < c leads to contradiction, and thus 
either GU{b} or GU{c} can be extended to a proper filter, not containing a. 


Exercise 2.7.13 (=) 


We need to prove a slightly more general statement, namely: 


Let T F wy. Then for every Kripke model C and every state c 
of C, the condition c Ik T implies c IF y. 


(An alternative of this generalization is to remember that for each state c, 
the set of all d with c < c makes a Kripke model.) As an example consider 
the induction step for rule (VE). Assume that we have derived T F y from 
the three assertions: T, Y F y and T, V F y and TE yvv. Let clIKT. By 
the induction hypothesis we have c IF Y Vv, and thus either c IF w or c IF ¥. 
Assume the first case and we have c IF T, y. By induction hypothesis we get 
clk g. 


Exercise 2.7.14 


The induction fails in the case of disjunction. 
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Exercise 2.7.17 


First do the previous two exercises. Now assume that ¢ is a classical tautol- 
ogy (the other direction is obvious), but ~~g is not valid intuitionistically. 
This means that there is a Kripke model with a state c, such that c IF ~g. 
Without loss of generality, we can assume that c determines all propositional 
variables in y. Indeed, suppose that c does not determine a variable p. Then 
there isac’ > c with c | p, and we can take c’ instead. From Exercise 2.7.16 
we obtain that c lk y, a contradiction. 


Exercise 4.6.4 


14.0.12. LEMMA (Newman’s Lemma). Let — be a binary relation satisfying 
SN. If — satisfies WCR, then — satisfies CR. 


PROOF. We give the proof in the case where — satisfies FB, i.e., for all 
M € L the set {N | M — N} is finite. [This was the case the hint aimed 
at. See another proof at the end of the note.| Since — satisfies FB and SN, 
there is for any M an m so that any reduction sequence from M has length 
at most m.1 

Assume — is SN and WCR. Given M1, M2, M3 € L where Mı — M2 and 
M,— M3, we must find M4 € L such that 


My Z 


Ma 


Since — is strongly normalizing, for every M € L there will be a longest 
reduction starting in M. Let |M| € N denote the length of this reduction. 
Assume Mı, M2, M3 E€ L such that Mı — Mə and Mı —> M3. We proceed 
by induction over |M;|: 

Case |Mı| = 0: Since the longest reduction has length 0, it must be the 
case that Mı = Mə and Mı = Ms, and thus M4 = M, is the desired term. 

Case |M| > 0: Assume for all Ny € L such that |Ni| < |M], if Ni —> N2 
and Nə — N3 then there exists N4 such that Nə —> N4 and N3 —> N4. 


1How does this follow? Recall König’s Lemma which states that if a tree—which is 
finitely branching, i.e., each node has finitely many children—is infinite, then it must have 
an infinite branch. Now, given M, consider the tree where the root is labeled with M, and 
for any node labeled with K, if K — N then the node labeled K has a child labeled N. 
Since — satisfies SN, there is no infinite branch. Also, there cannot be arbitrarily long 
finite sequences, because then the tree would be infinite, and then by Konig’s Lemma 
there would be an infinite branch, contradicting SN. 


237 


If Mı —> Mə has length 0 the desired term is M3: 


Similarly if Mı —> M3 has length 0. 
Thus assume that Mı —> Nə —> Mo and Mı —> N3 —> Ms, 


Mı 


ea Ka 1 


No N3 


M> M3 


Since — is WCR from Mı — No and Mı — N3 we get a term N € L such 
that Nə —> N and N3 —> N 


| S 
Mə N M3 


Since Mı > No—» N, |No| < |Mi|. Applying the induction hypothesis we 
thus get a term M4 € L such that Mə —> Mj and N— Mj 
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Then N3 —> Mj and N3—» M3 and hence by the induction hypothesis we get 
a term M4 € L such that M4 —> My and M3 —> M4 


Mə N M3 
KS x 
M; > 
Mg 
i.e., Mə —> M4 and M3—» M4. This concludes the proof. oO 


14.0.13. PROPOSITION. There is a binary relation satisfying WN and WCR, 
but not CR. 


PROOF. Consider L = {M, Myp, N, Nyp} and the relation — given by 


noh 
M ee N 
Da 


The relation is not Church-Rosser: for M € L we have two reductions 
M — Myp and M — N — Nyp, but there is no term in L such that MNF 
and Nyp both reduce to this term (because both are in “normal form”). 

The relation is Weak Church-Rosser: if M — Myp and M — N, then 
Myr is a common reduct. Similarly for N. 

Finally, we have that — is weakly normalizing since any reduction can 
always end in either Myp or Nyp. (It is obviously not strongly normalizing 
because we have an infinite reduction M > N > M —.---.) oO 


14.0.14. COROLLARY. Let Mı € A be typable in A — á la Curry and assume 
that Mı —> Mz and Mı —3 Mz. Then there is an M4 € A such that 
Mo = Ma and M3 73 M4. 


PROOF. Let L = {M e Aldo. F M : o} and consider —>=—>g. By The- 
orem 4.10 — satisfies SN and by Exercise 1.72 — satisfies WCR, thus by 
Newman’s Lemma — satisfies CR, i.e., ~g is Church-Rosser on L—the set 
of Curry-typable terms. oO 
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How does one prove Newman’s Lemma in case — does not necessarily 
satisfy FB? As follows. 


PROOF. Let — be a relation on L satisfying SN and WCR. As usual, a 
normal form is an M €E L such that for all N € L, MAN. 

Since — satisfies SN, any M € L reduces to a normal form. Call M 
ambiguous if M reduces to two distinct normal forms. It is easy to see that 
— satisfies CR if there are no ambiguous terms. 

Now, for any ambiguous M there is another ambiguous M’ such that 
M — M'. Indeed, suppose M —> Nı and M — Nə. Both of these reductions 
must make at least one step since Nj and Nə are distinct, so the reductions 
have form M — Mı —> N; and M — Mə — No. If Mı = Me we can choose 
M' = Mı = Mo. If Mı 4 Mz we now by WCR that for some N3, Mı —> N3 
and Mə — N3. We can assume that N3 is a normal form. Since Nj and N2 
are distinct, N3 is different from Mı or Nə so we can choose M’ = M; or 
M'= M3. 

Thus, M has an infinite reduction sequence, contradicting SN. Hence, 
there are no ambiguous terms. oO 


Exercise 5.6.1 


One possibility is S(S(KS)K)I. 


Exercise 5.6.9 


It should be easy to see that all types that can be assigned to K, I and S° 
must be respectively of the form: 


e T7T>0>T; 


eT—T; 


e (T—=T)>(T>T>T)>(T>T)>T>T. 


We can take all instances of the above formulas as our Hilbert style axioms. 
But we can easily simplify the the system, replacing the last axiom by: 


e (T—>=T>T)>(T>T)>T>T. 


A Hilbert style proof will now correspond to a combinatory term built from 
the combinators of Exercise 5.6.8, and without loss of generality, we can 
only deal with terms in normal forms. 

Suppose we have a proof of (p > p — q) —> p — q, where p and q are 
propositional (type) variables. Let M be the corresponding combinatory 
term in the language of Exercise 5.6.8, and assume that M is in a normal 
form. 
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Clearly, M is neither K,,, nor S,,,, nor L. If M = K,,N, then 
N proves p — q, which is not a valid tautology. Also M = S,,,PQ or 
M =S,,,,,N is impossible, because types of these expressions do not match 


(p> p->q)—> pg. 


Exercise 6.8.1 


a) To reduce ?+ M:? to F M: ?, observe that a term M with free 
variables 71,... ,£n is typable if and only if Azı ...&n.M is typable. 


b) In order to find out if a closed term M is typable, ask if x : a F KaM :a. 


Exercise 6.8.2 

Of course tg = Za, and then we proceed by induction as follows: tg., = 
Ax.Kt,(Azy.z(yx)(yte)). 

Exercise 6.8.3 (Author’s hint) 


Adopt the technique of Exercise 6.8.2 to write lambda-terms ¢),.,) such that 
x € FV(tiy.7)) and tjs:7] is typable in a context A if and only if A(x) = S(T), 
for some S. (Use a fresh variable xq, for every type variable a occurring in T.) 
Then reduce the problem of T F M :? with T = { (x1 : 71),... , (£n : ™m)} to 
the problem ?+ M’: ?, where M’ = Az.z Mtiini] +- tenira]: 


Exercise 6.8.3 (Solution by Henning Makholm) 


(This is a fragment of Henning’s solution containing the reduction of prob- 
lem (3) to problem (4).) 


DEFINITION. Let T? denote a type environment of the form discussed in 
exercise 6.29. That is, one that maps all variables to distinct type variables. 


DEFINITIONS. I consider the following problems: 


(3) ?FM:T; 


In each of the following reductions, xı up to £n will be understood to be the 
free variables of the given M. 


REDUCTION FROM (3) TO (54). To answer ? + M : 7, ask 


T? F Azi- anyz.y(zM)(2t,) : ?. 
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REDUCTION FROM (5!)To (4). This is the harder part. Without the T° 
it is not trivial to design a subterm that is forced to have a primitive type 
(one that cannot be destructed). 


SOLUTION WITH PRODUCT TYPES. One simple solution can be obtained if 
we assume that we have product types at our disposal, together with pair 
and projection operators. To answer T° + M : ?, ask: 


? FK ((Ax1:-- £n. M) (£1, £1) (£2, £2) . . . (Ln, En?) 
(Ari ++ €n- M)(Ayr-y1)(Ayry2-y1) --- (Ayr Yn-y1)) 2? 


Clearly, if M has a typing in T° then this complicated term is also typable. 
For the other direction, I exploit the existence of unique principal types. If 
the long term is typable, then Azı: -+ £n.M will have a principal type 


T> >m. 


Since that principal type have instances where the 7;’s are arrow types as 
well as where they are pair types, we conclude that the 7;’s must be type 
variables. Furthermore, because Ayı: +: yi-yi and Ayi-:+yj-y1 cannot have 
equal type for i Æ j, the 7;’s must be different type variables. Thus, modulo 
renaming of type variables we have T? F- M : ø. 


IMPLICATIONAL SOLUTION. My solution is based on an “encoding” e of 
types and terms?: 


LEMMA. 
elfl + M:7rthenDTt M :r. 


elfAtM:othenI+ M:7, forsome I and 7 with T = A and 7 =o. 


The proof of the first part is easy. The other part follows by induction with 
respect to M. o 


?Never mind that 7 is not LOGSPACE-computable because T can be exponentially 
bigger than 7. It is not used in the actual reduction, just in the argument for its correct- 
ness. The important thing is that M is LOGSPACE-computable by having a treeless, 
linear definition. 
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Now, to answer T° F M : ?, ask 
? H (Azi: ++ &n.-M)(Azy1.2z)(Aryry2.2) . .. (AzYy1 + Yn) : ?- 


It is easy to see that this holds whenever M is typable in T°. Conversely, 
assume that the massaged and wrapped M is typable. We know then that 
M is typable and thus so is M. Let ([',7) be the principal pair of M. 
What remains to be shown is that T is T°. We know that ['(a;) = T'(2;) 
has an instance which is a type of Azy,---y;.z. But by inspection of the 
definition of e we see that this can only be the case when T(z;) is a type 
variable. (This is because all compound types are translated into types with 
“symmetric” first arguments.) Furthermore the type variables in I have to 
be different, because Azy)---yi.z and Azy1--- yj-z do not have a common 
type for i Æ j. Thus T is a T° which completes the reduction. oO 


Exercise 6.8.6 


6 


Take the equations “a, = ag > Q2”, “ag = a3 > Q3”, .., “An—1 = An ` Qn”. 


Exercise 6.8.7 


Use non-unifiable terms as different flags. Represent n-ary operators as 
combinations of arrows, using flags to identify operators. 


Exercise 6.8.8 


Label all subterms occurring in the equations and keep labels unchanged in 7 
in steps (a) and (d). A variable x is called defined iff there is an equation 
of the form “x = t” or “t = x”. The occurrence of x as a left-hand or a 
right-hand side of such an equation is called main. Note that “x = y” has 
two main occurrences. 

Proceed by induction w.r.t. the following parameters: 1) number of la- 
bels; 2) number of equations; 3) number of main occurrrences of defined 
variables; 4) number of all occurrrences of defined variables. Each applica- 
tion of rule (c) decreases (1) and does not increase the other parameters. 
Rule (e) decreases (2) without affecting (1), and rule (a) decreases (3) with- 
out increasing (1) or (2). Rule (d), used with caution (i.e., only when z 
occurs in “r = s” and when t is not a defined variable), will not increase any 
of the parameters (1)—(3) and will decrease (4). Thus, after a finite number 
of applications of rules (a), (c), (d) and (e) we obtain a system of equations, 
that is not normal only for the following reasons: there may be some equa- 
tions of the form “t = x” and there may be some equations between defined 
variables. Use rules (b) and (d) for a clean-up. 
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Exercise 6.8.10 


Use acyclic graphs instead of trees to represent algebraic terms. Proceed by 
identifying nodes of these graphs as long as either a contradiction is found 
(a loop or an attempt to place two different operation labels at a node) or 
no more nodes need to be identified. 


Exercise 6.8.11 


Just add one more equation. 


Exercise 6.8.12 


Take the term (Av.Ku(A%ay - - - Zan -tiw:7])) N, where N is any inhabitant of 7, 
and t/,.;] is as in Exercise 6.8.3. 


Exercise 6.8.14 


Let a pair (T, T) be called semi-principal iff it has the properties mentioned in 
Exercise 6.8.13. We show that if (T, 7) is semi-principal then there is at most 
one Church-style BCK-term M in long normal form such that TH M : 7. 
The proof is by induction w.r.t. the total number of arrows in (T, 7). Assume 
first that T = 7, > T2. Then M cannot be of the form 7M,...Mn, as it 
would not be fully-applied (a has too few arguments). Thus, M = dAy.N, 
with fully applied N, and we apply the induction hypothesis to the pair 
(TU fy: ny T) 

The remaining case is when 7 is a type variable a. There is at most one 
variable x declared in I’ to be of type 01 — --- — op» — a, since a occurs at 
most twice. Thus M = xNj...Ny. Apply the induction hypothesis to pairs 
(I’,o;), where I” is I without the declaration (x : c1 > --- > op > a). 


Exercise 6.8.18 


Modify the algorithm of Lemma 6.6.1 so that it searches for all inhabitants 
rather than for only one. This process may loop by asking a question of the 
form T F ? : a, which has already been asked. We can effectively identify all 
loop-free solutions and all loops. If we have a loop caused by a question that 
has a loop-free solution, then the answer is: “infinite”. (Note the similarity 
of this argument to the pumping lemma for CF-languages.) 


Exercise 6.8.20 


Assume all 7;’s are inhabited. We prove indirectly that then y is not inhab- 
ited. Assume | Nj: 7; and | M:y. Then | MN,---N,: a, which isa 
contradiction because type variables are not inhabited. 
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The proof that ọ is inhabited if there is a 7; that is not inhabited is by 
induction on the size of y. Since a is the only type variable in y, type 7; has 
the form a] > +: > om — a. If any of the o;’s were not inhabited then 
by the induction hypothesis 7; would be inhabited, but we know it is not. 
Thus for some N;’s we have F Nj: oj. Then F Ary--+%p.2;N,...Nm: 9. 


Exercise 6.8.21 


The formula y must have the form Yı > --- > Yn —> p. Classically, this 
is equivalent to (#1 A++- A Yn) > p. For this to be a tautology, some y; 
must be false in a valuation that sets p to be false. Hence that y; is not 
classically valid, so it cannot be intuitionistically valid either. That means 
that y; is not inhabited when viewed as a type. Then ọ is inhabited by 
Exercise 6.8.20, and y is thus intuitionistically valid. 


Exercise 6.8.22 


First reduce the general case to the case when 7 is a type variable a. To prove 
that T1,...,7 F a, consider a substitution S such that S(a@) = 7, >- —> 
Tn — a, and $(3) = p, for G 4 a. Show that all formulas S(7;),... , S(t) 
are valid, and conclude what you need. 


Exercise 7.7.6 


Consider the term M =< 71(FK),72(F'K) >, where F = Ax. < x, dy.x >. 
Then F can be assigned all instances of the type a > (a A (8 — a)), and 
since K has both the types y > y —> y and y > (y > ¥) > y, we can 
derive that M : (y > y > 7) A (8 => y > (7 > 7) > 7). But M —, FK, 
and FK cannot be assigned this type. 


Exercise 7.7.8 


The example term in the above solution is an untyped 7-redex that is not 
an erasure of a typed 7-redex. The Church-style version of that term uses 
two different K’s. 


Exercise 7.7.9 


The problem is that the conclusion of the elimination rule is not neces- 
sarily identical to a premise of any of the introduction rules. Thus, in an 
elimination-introduction pair, one eliminates and introduces possibly differ- 
ent things. 
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Exercise 7.7.10 


There is no canonical object of type L, so one can argue that no eta rule 
makes sense. By analogy to the eta rule for V one may only postulate 
that an “artificial” use of l-introduction should be avoided. This leads to 
something like e, (M) — M, for M: L. 

Exercise 8.9.1 (Hint) 


For the right-to-left direction, proceed as follows: 


1. Show that | (y > 4) > ~y > 4) > y. 


2. Let &1,... ,@n be the propositional variables of y. Let p be a Boolean 
valuation. Now let 


Also, let 
= { p if p(y) = 
~p if p(y) =9 
where p is lifted to formulas according to the usual truth-table seman- 
tics. Show that {a4,... ,@h} F g. 


3. Prove the right-to-left direction. 


Exercise 9.5.2 


The construction of y’ is by induction w.r.t. the length of the quantifier 
prefix of y. If y is quantifier-free then y’ = y. If y = Yxy(x) then y’ = 
w(x). If p = Axry(x) then vy’ = y’(c), where c is a constant such that 
+ w(c). (Here we apply the induction hypothesis to w(c).) 


Exercise 9.5.3 


For a given formula there is a finite number of possible replacements of 
existentially quantified variables by constants. To verify provability of a 
prenex formula one checks provability of these replacements (provability of 
open formulas is decidable, like for the propositional case). 


Exercise 9.5.4 (Intuitionistic case) 


The argument is of course as follows: if every intuitionistic first-order for- 
mula was equivalent to a prenex formula, then intuitionistic first-order logic 
would be decidable by the previous exercise. Note however that to apply 
this argument one needs to know that the translation to prenex normal form 
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must be effective, and we can assume only the existence of a prenex formula 
equivalent to any given y. But one can effectively list all proofs until a 
proof of p > y, for a prenex formula w is found, and this gives an effective 
translation. 


Exercise 9.5.5 


Consider the formula 4xz(P(0)V P(1) — P(x)), where P is a unary predicate 
symbol and 0 and 1 are constants. It should be clear that no formula of the 
form P(0) v P(1) — P(t) is classically valid. The proof of Corollary 9.3.2 
breaks down in the “obvious” and omitted part, and the confusion is cre- 
ated by the principle of contraction (two occurrences of the same formula 
in a sequent are treated as a single occurrence). In a sequent calculus with 
explicit contraction rules, the last rule of our proof would be the right con- 
traction rule. In our version of sequent-calculus, the contraction is implicit, 
and the last rule must indeed be (3R). But the premise of this rule may be 
for instance of the form: 


| Je(P(0) v P(1) > P(2)), P(0) v P) > P(1), 


because a classical sequent may have two formulas at the right-hand side. 
The second last rule is also (JR) with premise 


E P(0) v P(1) > P(0), P(0) v P(1) > P(A), 


a classical proof of which should be easy. 


Exercise 9.5.7 (Hint) 


The proof is similar to that of Proposition 2.3.4. Choose c € X. We trans- 
form a model A where relations are valued over P(X) into an ordinary 
model A, by defining 


A 


(a1,... , an) Er? iff cE r4(a1,... ,an). 


Both our models have a common domain A. Let v be a valuation in A. We 
extend v to terms and formulas in the usual way (the values of formulas 
range over P(X)). One proves by induction the following claim: 


cevy) if A,v Ey, 


for all y. (Note that the right-hand side makes sense, because v can also be 
regarded as ordinary two-valued valuation in A.) Note that in the right-to- 
left direction in the case of V, one uses the fact that lower bounds in P(X) 
are actually intersections (if c belongs to all sets in a family then it belongs 
to their glb).3 

Now if A, v |‘ ọ then there is c € u(y), and thus A, v j y as well. 


3One has to use ultrafilters for the case of arbitrary Boolean algebras. 
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Exercise 9.5.8 


Algebraic counterexamples, after [88] 


The domain of individuals A is the set of all positive integers. The Heyting 
algebra H is the set of all open sets of R?. We take y and w as atomic 
formulas p(x) and q(y), and we abbreviate p(a)4(n) by P(n) and q(y)4(m) 
by Q (the latter will not depend on m). The symbol w; denotes the i-th 
point with rational coefficients, according to some fixed order. 


2) 


12) 


Take P(n) = R? — {wn}, a full space without one rational point. The 
intersection of all sets P(n) is R? with all rational points deleted. This 
set has an empty interior, and thus the value of the formula -=Vz p(x) is 
the full space. On the other hand, the complement in H of every P(n) 
is empty and the value of the formula at the right-hand side is the 
union of empty sets. 


Let Q be the whole space without the point (0,0), and let P(n) be the 
set of all points with distance from (0,0) greater than + (full space 
without a disk). The union of all P(n)’s is equal to Q, and the value 
of the left-hand side is Q > Q = R?. But Q > P(n) = P(n), for all n, 
and the union of these sets (the value of the right-hand side) does not 
contain (0,0). 


Take Q as above and let P(n) be the open disk centered at (0,0), with 
radius equal to L, The value of the left-hand side is R? because each 
set QU P(n) covers the whole space. The value of the right-hand side 
is Q because the glb in H of all sets P(n) is empty. (Their intersection 
is a one-point set which is not open.) 


Let Q be empty, and let P(n) be as in (2). The value of the left-hand 
side is the full space, because the glb of all sets P(n) is empty. But 
the value of the right-hand side is empty. 


Let P(n) be as in (2) and (8). Then ~P(n) is empty and thus P(n) U 
~P(n) = P(n). The intersection of these sets has an empty interior, 
thus the value of our formula is empty. 


Take P(n) = A for even n and P(n) = B for odd n where A and B 
are complementary open halves of the space. (Note that this formula 
has a propositional counterpart: (p V q > p) V (pV q > q), which is 
also not valid.) 


Counterexamples in Kripke models 


2) 


Hint: adopt the solution of Exercise 2.7.9(8). 
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4) Hint: first make a counterexample for the propositional version of this 
law: (p > q Vr) > (p > q) V (p > r). 


6) The model consists of two states c < d, with Ae = {1} and Ag = 
{1,2}. Let c,1 IF y(x) and cK y, and let d IF Y and d, 1 IF (x), but 
d,2¥ (x). Then c lk Vr(w V y(x)), because d, 2 IF w, but c wv 
Va p(x), because d,2 WK y(x). 


8) Generalize (2). 


10) The set of states is {cn : n E€ N}, the domain for each state is the set of 
integers, and c;, j IF y if and only if j > 7. Then c; FW =-Va2(y V ~y). 
Otherwise there would be c; with c; IF Va(y V 7y), in particular 
ci, i IF pV ay, and this does not hold. 


12) The model consists of two states c < d, with Ae = {1} and Ag = 
{1,2}. Let c, 1 (x), and let dq,1 ¥ (x) and d,2 IF v(x). Then 
cH Ax(sy pyly). > p(x)), as otherwise c,1 IF 3y (y). > p(x), which 
implies d,1 IF (x). 


Exercise 9.5.9 


e Jr(p(z) > Va p(x)) 


Heyting counterexample as for Exercise 9.5.8(2). Kripke counterexample as 
for Exercise 9.5.8(6). 


e Axr(y(0) V el) > p(x)) 
Similar to Exercise 9.5.8(12). 


e Vz 79 (2). = —~—Yz y(x) 


Heyting counterexample as for Exercise 9.5.8(2). Kripke counterexample as 
for Exercise 9.5.8(10). 


e dr 79 (2). > ~Ir y(x). 


Heyting counterexample as for Exercise 9.5.8(12). A Kripke counterexample 
consists of three states c < d,e (with d,e incomparable), all with domain 
{1,2}. The forcing relation consists only of d,1 IF y(x) and e,2 IF g(x). 


Exercise 9.5.10 


The implication from right to left is always valid, so we only consider the 
implication Va(w V y(x)) > Y V Yx y(x). Assume that A, = A for all c in 
our model. Let c,a lk Va(w V y(a)), and suppose that c,a ¥ y. Thus for 
all b € A it must be that c,b,a lk (x). By monotonicity, c’,b,a lF y(x), 
for all d > c. It follows that c,a lF Va y(x). 
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Exercise 9.5.11 


First observe that c’,b,a/- wy V ~y always holds if c” is a maximal state. 
Now suppose c, a I- =>Vr(y V ~y) in a finite Kripke model. There is c > c 
with c,alF ~Va(y V ~y). Take a maximal state c” > œ and we obtain 
d, b,a K pV -7y. 


Exercise 10.7.11 


Consider a logic where all formulas of the form Vx y are equivalent to true. 
Then the other two axioms remain sound but Vz y(x). > y(t) is not valid. 


Exercise 11.8.1 


e Va (=(xz = 0) > Ay(z@ = y + 1)) 


We use induction scheme applied to the formula =(# = 0) > dy(a# = y+1). 
This means we have to show that the following formulas are provable: 
(0 = 0) > 3y(0 = y + 1); 

Va [(~(x = 0) > Jy(z = y + 1)) > ~(x +1 = 0) > Iyl +1 =y + 1)], 
and then it suffices to apply modus ponens twice. The first formula is proven 
with help of the first axiom, which can be generalized to 0 = 0. The second 
formula is easily derived from Jy(x + 1 = y + 1), and this is a consequence 
of y +1 = y+ 1 (first axiom). 


e YVrYyYz (z =y > y=z>zr=z]); 
This is an instance of the third axiom. 
e YVrVyVYz ((£z +y) +z=x+(y+z2)) 


We prove Vz ((x +y) +z = x+ (y+ z)) by induction and then generalize over 
x and y. The first step is (x +y)+0 = z + (y +0) and is an easy application 
of the axiom Vz (x + 0 = x) and the transitivity of equality. Then we must 
derive (x+y)+(z+1) = 2+(y+(z4+1)) from (x+y)+z=2+4+(y+z). With 
the axiom VaVy (x + (y + 1) = (x + y) +1) and the transitivity of equality, 
we can formalize the calculation (x + y) + (z+ 1) = ((a@+y)4+2)4+1= 
(x+ (y +z))+1=g+((y+z)+1)=z+ (yt (z+1)). 


e YVrYy (zr +y =y+ rx) 


Hint: First prove by induction that Yy (0 + y = y + 0). This is the base 
of the main induction (with respect to x). The induction step is to derive 
Vy ((c+1)+y=y+(a+4+1)) from Vy (z +y = y + x). This also goes by 
induction (with respect to y). Have fun! 
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Exercise 11.8.3 


Suppose a function f is representable by a formula y. Then f is strongly 
representable by the formula 


way) = Ele p(z, z). A (z, y)) v (male oz). Ay = 0). 


We show PA F Vi Aly Yy(z, y). (Then y implies y and representability follows 
easily.) Begin with PAF V V 7, where J = !z y(Z, z). Then one can show 
that PAF 0 > Aly(0 A v(Z,y)) and PAF 70 = Jly(-0 A y = 0). Thus 
PAF Aly(VAy(Z, y)) VAly(A0 Ay = 0) and it remains to permute V with Aly. 


Exercise 11.8.8 


By translation, we have HA F ~~o (note that t/(@,y) = 0 is an atomic 
formula), and thus HA F (o° — @) > o. Now, the formula 02 is equivalent 
to o (because  dy(v V Jy) > Ay) and thus HA F (@ > o) — o. Then 
HAF ọ, because F 9 > o. 


Exercise 12.7.1 (Hint) 
Cf. Exercise 9.5.10. 


Exercise 12.7.2 


For a model with a constant domain D we have 
Go le Ypy if veer le o, forall ge). 


(One does not need to refer to c’ > c because of monotonicity.) 


Exercise 12.7.3 


This exercise contains a little trap: the notion of a complete model refers 
to all formulas, including those containing V, A and J. But one can also 
consider Kripke models for the language containing only — and VY, satisfying 
the appropriate (weaker) notion of completeness. Then the semantics of the 
formula 


T+0:=Va((t > a) > (o > a) > a) 


does not have to coincide with the expected semantics of r V a. Indeed, 
consider a model of three states co, cı and cg with a constant domain D = 
{{}, {er}, {c2}, {c0, c1, co} } and with cı IF p and c2 IF q, and no other forcing. 
This model is complete with respect to — and Y, and we have co IF p+ q. 

The case of A is different: if a model is complete with respect to —> 
and Y, then c IF Va((t = o = a) > a) if c IF 7 and c IF ø. 
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Exercise 12.7.13 


In the context {y : L,z: Vy(a — y — ()} one can derive zyz : 8. Now 
consider the context {y : L,x : VaB(Vy(a —> y —> L). — B) and derive 
zz: L. Thus our term has type VaG(Vy(a —> y > 8). — 8). — L in the 
context {y: L}. 


Exercise 12.7.15 


Think of types as finite binary trees with leaves labeled by type variables 
and internal nodes corresponding to arrows). Some of the internal nodes are 
labeled by quantifiers. 

Suppose that xæ is typable in an environment containing the declara- 
tion (x : 7). The type T must begin with one or more universal quantifiers, 
and one of these quantifiers must bind a type variable occurring at the very 
end of the leftmost path of the type. (Otherwise self-application is impossi- 
ble.) Thus, a type assigned to Ax. zx must have the form (Var) — o with 
one of the @’s at the end of the leftmost path. This observation applies to 
both copies of Ax. xx which results in that two different quantifiers attempt 
to bind the same variable — a contradiction. 


Exercise 12.7.16 (After [111]) 


The type o assigned to K must have the form: 
o = Y(T > VG(p = 7")), 


where 7’ is an instance of r. The rightmost path of 7’ must be at least as 
long as the rightmost path in r. In addition, one of the variables æ, say a, 
must occur at the end of the rightmost path in 7. The same a must remain 
at the end of the rightmost path in the instance 7’, at the same depth. 

The type of the second c2 in coc2K must have the form V¥(o9 > o), 
where o can be obtained from og by instantiating 7. It begins with Va@ and 
has occurrences of a at the same places as ø does. In particular there is an 
occurrence of aœ at some depth n at the rightmost path of the left subtree 
of co and at depth n + 1 at the rightmost path of the right subtree of co. 
Now, oo is the type of f in f(fax) and o is the type of Ax. f( fx). No matter 
what is the type of x, we can note that the asymetry of og is doubled in 9, 
and thus the rightmost path in 9 must be of length at least n+ 3. Although 
Y¥(o0 — o) may still be a good type for c2, a term of this type cannot 
be composed with itself, as the positions of œ cannot be changed by just 
instantiating Ñ. 


Exercise 12.7.18(12.48) 


An infinite sequence of Church-style beta reductions M; >g Mj+1 erases to 
an infinite sequence of Curry-style terms |M;|, where at each step we either 
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have |M;| >g |Mi+1| or |M;| = |Mi4i|. The latter case must hold for almost 
all i, and is only possible when almost all steps M; —g Mj+1 are caused by 
type reductions of the form (Aa.M)t —>g Ma := 7]. But each of these 
steps decreases the number of A’s in our term, so this process must also 
terminate. 


[1] 


[2] 


[10] 


Bibliography 


A.R. Anderson and N.A. Belnap. Entailment. The Logic of Relevance 
and Necessity, volume I. Princeton University Press, 1975. 


A.R. Anderson, N.A. Belnap, and J.M. Dunn. Entailment. The Logic 
of Relevance and Necessity, volume II. Princeton University Press, 
1992. 


T. Arts. Embedding first order predicate logic in second order propo- 
sitional logic. Master’s thesis, Katholieke Universiteit Nijmegen, 1992. 


T. Arts and W. Dekkers. Embedding first order predicate logic in 
second order propositional logic. Technical Report 93-02, Katholieke 
Universiteit Nijmegen, 1993. 


S. van Bakel, L. Liquori, S Ronchi della Rocca, and P. Urzyczyn. 
Comparing cubes of typed and type assignment systems. Annals of 
Pure and Applied Logic, 86:267—-303, 1997. 


F. Barbanera, M. Dezani-Ciancaglini, and U. de’ Liguoro. Intersection 
and union types: syntax and semantics. Information and Computa- 
tion, 119:202-230, 1995. 


H.P. Barendregt. The Lambda Calculus: Its Syntax and Semantics. 
North-Holland, second, revised edition, 1984. 


H.P. Barendregt. Lambda calculi with types. In S. Abramsky, D.M. 
Gabbay, and T.S.E. Maibaum, editors, Handbook of Logic in Computer 
Science, volume II, pages 117-309. Oxford University Press, 1992. 


H.P. Barendregt, M. Bunder, and W. Dekkers. Completeness of some 
systems of illative combinatory logic for first-order propositional and 
predicate calculus. To appear in Archive für Mathematische Logik, 
1996. 


H.P. Barendregt, M. Bunder, and W. Dekkers. Completeness of the 
propositions-as-types interpretation of intuitionistic logic into illative 
combinatory logic. To appear in the Journal of Symbolic Logic, 1996. 


253 


254 


Bibliography 


[11] J. Barwise. Handbook of Mathematical Logic. North-Holland, 1977. 


[12] S. Berardi. Type Dependence and Constructive Mathematics. PhD 


[13 


[14 


[15 


[16 


17 


18 


19 


20 


21 


22 


] 


] 


] 


] 


thesis, Universita di Torino, 1990. 


M. Bezem and J. Springintveld. A simple proof of the undecidability 
of inhabitation in AP. Journal of Functional Programming, 6(5):757— 
761, 1996. 


R. Bloo and K. Rose. Preservation of strong normalisation in named 
lambda calculi with explicit substitution and garbage collection. In 
CSN ’95 - Computer Science in the Netherlands, pages 62—72, 1995. 


V. Breazu Tannen, D. Kesner, and L. Puel. A typed pattern calculus. 
In Logic in Computer Science, pages 262-274, 1993. 


S. Broda and L. Damas. On principal types of stratified combinators. 
Technical Report DCC-97-4, Departamento de Cincia de Computa- 
dores, Universidade do Porto, 1997. 


L.E.J. Brouwer. Intuitionistische splitsing van mathematische grond- 
begrippen. Nederl. Akad. Wetensch. Verslagen, 32:877-880, 1923. 


A. Church. A formulation of the simple theory of types. Journal of 
Symbolic Logic, 5:56-68, 1940. 


R. Constable. Constructive mathematics and automatic program writ- 
ers. In Proceddings of the IFIP Congress, pages 229-233, Ljubljana, 
1971. 


R. Constable. Programs as proofs: A synopsis. Information Processing 
Letters, 16(3):105-112, 1983. 


H.B. Curry. Grundlagen der Kombinatorischen Logik. teil I. American 
Journal of Mathematics, LII:509-536, 1930. 


H.B. Curry. Grundlagen der Kombinatorischen Logik. teil II. Ameri- 
can Journal of Mathematics, LII:789-834, 1930. 


H.B. Curry. Functionality in combinatory logic. Proceedings of the 
National Academy of Science USA, 20:584-590, 1934. 


H.B. Curry and R. Feys. Combinatory Logic. North-Holland, 1958. 


H.B. Curry, J.R. Hindley, and J.P. Seldin. Combinatory Logic II, 
volume 65 of Studies in Logic and the Foundations of Mathematics. 
North-Holland, 1972. 


D. van Dalen. Intuitionistic logic. In Handbook of Philosophical Logic, 
volume III, pages 225-339. Reidel Publ. Co., 1986. 


Bibliography 255 


[27] 


33 


34 


35 


37 


38 


39 


L. Damas and R. Milner. Principal type schemes for functional pro- 
grams. In Conference Record of the Annual ACM SIGPLAN-SIGACT 
Symposium on Principles of Programming Languages, pages 207-212, 
Jan. 1982. 


N.G. de Bruijn. A survey of the project AUTOMATH. In Seldin and 
Hindley [98], pages 579-606. 


A. Degtyarev and A. Voronkov. Decidability problems for the prenex 
fragment of intuitionistic logic. In Logic in Computer Science, pages 
503-512, 1996. 


W. Dekkers. Inhabitation of types in the simply typed -calculus. 
Information and Computation, 119:14-17, 1995. 


G. Dowek. The undecidability of typability in the lambda-pi-calculus. 
In M. Bezem and J.F. Groote, editors, Typed Lambda Calculus and 
Applications, volume 664 of Lecture Notes in Computer Science, pages 
139-145. Springer-Verlag, 1993. 


A. Dragalin. A completeness theorem for higher-order intuitionistic 
logic. an intuitionistic proof. In D. Skordev, editor, Mathematical Logic 
and its Applications, pages 107-124. Plenum Press, New York, 1987. 


C. Dwork, P.C. Kanellakis, and J.C. Mitchell. On the sequential nature 
of unification. Journal of Logic Programming, 1:35-50, 1984. 


J.E. Fenstad, editor. Proc. Second Scandinavian Logic Symposium. 
North-Holland, Amsterdam, 1971. 


S. Fortune, D. Leivant, and M. O’Donnell. The expresssiveness of 
simple and second-order type structures. Journal of the Association 
for Computing Machinery, 30:151-185, 1983. 


D.M. Gabbay. On 2nd order intuitionistic propositional calculus with 
full comprehension. Archiv für Mathematische Logik und Grundlagen- 
forschung, 16:177-186, 1974. 


D.M. Gabbay. Semantical Investigations in Heyting’s Intuitionistic 
Logic. D. Reidel Publ. Co, 1981. 


J.H. Gallier. Constructive logics, part I: A tutorial on proof systems 
and typed A-calculi. Theoretical Computer Science, 110:249-339, 1993. 


G. Gentzen. Untersuchungen über das logische Schliessen. Mathema- 
tische Zeitschrift, 39:176-210, 405-431, 1935. 


256 


Bibliography 


[40] 


[43] 


[44] 


J.H. Geuvers. Conservativity between logics and typed lambda-calculi. 
In H. Barendregt and T. Nipkow, editors, Types for Proofs and Pro- 
grams, volume 806 of Lecture Notes in Computer Science, pages 79- 
107. Springer-Verlag, 1993. 


J.H. Geuvers. Logics and Type Systems. PhD thesis, University of 
Nijmegen, 1993. 


J.H. Geuvers and M.J. Nederhof. A modular proof of strong nor- 
malization for the calculus of constructions. Journal of Functional 
Programming, 1(2):155-189, 1991. 


P. Giannini and S. Ronchi Della Rocca. Characterization of typings 
in polymorphic type discipline. In Proc. Symp. on Logic in Computer 
Sciene, pages 61-70. Computer Society Press, 1988. 


J.-Y. Girard. Interprétation fonctionelle et élimination des coupures 
dans l’arithmétique d’ordre supérieur. Thèse d’Etat, Université Paris 
VII, 1972. 


J.-Y. Girard. The system F of variable types, fifteen years later. The- 
oretical Computer Science, 45:159-192, 1986. 


J.-Y. Girard, Y. Lafont, and P. Taylor. Proofs and Types, volume 7 
of Cambridge Tracts in Theoretical Computer Science. Cambridge 
University Press, 1989. 


C.A. Goad. Monadic infinitary propositional logic. Reports on Math- 
ematical Logic, 10, 1978. 


K. Gödel. über eine bisher noch nicht beniintze erweiterung des finiten 
standpunktes. Dialectica, 12:280-287, 1980. (English translation: J. 
Philos. Logic, 9:133-142, 1980.). 


T.G. Griffin. A formulae-as-types notion of control. In Conference 
Record of the Annual ACM SIGPLAN-SIGACT Symposium on Prin- 
ciples of Programming Languages, pages 47-58. ACM Press, 1990. 


K. Grue. Map theory. Theoretical Computer Science, 102:1-133, 1992. 


R. Harper, F. Honsell, and F. Plotkin. A framework for defining logics. 
Journal of the Association for Computing Machinery, 40(1):143-184, 
1993. 


H. Herbelin. A A-calculus structure isomorphic to Gentzen-style se- 
quent calculus structure. In Computer Science Logic 1994, volume 933 
of Lecture Notes in Computer Science, pages 61-75. Springer-Verlag, 
1995. 


Bibliography 257 


[53] 


[54] 


55 


56 


57 


58 


59 


60 


61 


62 


63 


64 


67] 


[68] 


A. Heyting. Mathematische Grundlagenforschung. Intuitionismus. Be- 
weisteorie. Springer, 1934. 


J.R. Hindley. Basic Simple Type Theory, volume 42 of Cambridge 
Tracts in Theoretical Computer Science. Cambridge University Press, 
1997. 


J.R. Hindley and J.P. Seldin. Introduction to Combinators and A- 
calculus. Cambridge University Press, 1986. 


S. Hirokawa. Principal types of BCK-lambda terms. Theoretical Com- 
puter Science, 107:253-276, 1993. 


J. E. Hopcroft and J. D. Ullman. Introduction to Automata Theory, 
Languages and Computation. Addison-Wesley, 1979. 


W. Howard. The formulae-as-types notion of construction. In Seldin 
and Hindley [98], pages 479-490. 


G. Huet and G. Plotkin. Logical Frameworks. Cambridge University 
Press, 1991. 


S.C. Kleene. On the interpretation of intuitionistic number theory. 
Journal of Symbolic Logic, 10:109-124, 1945. 


S.C. Kleene. Introduction to Metamathematics. Van Nostrand, 1952. 


S.C. Kleene. Origins of recursive function theory. Annals of the History 
of Computing, 3(1):52-67, 1981. 


A. Kolmogorov. Zur Deutung der intuitionistischen Logik. Mathema- 
tische Zeitschrift, 35:58-65, 1932. 


G. Kreisel. Monadic operators defined by means of propositional quan- 
tification in intuitionistic logic. Reports on Mathematical Logic, 12:9- 
15, 1981. 


P. Kremer. On the complexity of propositional quantification in intu- 
itionistic logic. Journal of Symbolic Logic, 62(2):529-544, 1997. 


J.-L. Krivine. Lambda-Calculus, Types and Models. Ellis Horwood Se- 
ries in Computers and their Applications. Masson and Ellis Horwood, 
English Edition, 1993. 


M. Lob. Embedding first order predicate logic in fragments of intu- 
itionistic logic. Journal of Symbolic Logic, 41(4):705—-718, 1976. 


H.G. Mairson. A simple proof of a theorem of Statman. Theoretical 
Computer Science, 103(2):387-394, 1992. 


258 


Bibliography 


69 


70 


71 


72 


73 


74 


75 


76 


[77 


[78] 


S.D. Marlow. Deforestation for Higher-Order Functional Languages. 
PhD thesis, University of Glasgow, 1996. 


E. Mendelson. Introduction to Mathematical Logic. Wadswoth & 
Brooks/Cole Advanced Books and Software, third edition, 1987. 


E. Mendelson. Introduction to Mathematical Logic. Chapman & Hall, 
London, fourth edition, 1997. 


R. Milner. A theory of type polymorphism in programming. Journal 
of Computer and System Sciences, 17:348-375, 1978. 


J. Mitchell. Polymorphic type inference and containment. Information 
and Control, 76:211—-249, 1988. 


J.C. Mitchell. Foundations for Programming Languages. MIT Press, 
Cambridge, 1996. 


C.R. Murthy. Extracting Constructive Contents from Classical Proofs. 
PhD thesis, Cornell University, 1990. 


C.R. Murthy. Control operators, hierachies, and pseudo-classical type 
systems: A-translation at work. In ACM SIGPLAN Workshop on 
Continuations, 1992. 


B. Norström, K. Petersson, and J.M. Smith. Programming in Martin- 
Lof’s Type Theory, An Introduction. Oxford University Press, 1990. 


C.-H. L. Ong. A semantic view of classical proofs: Type-theoretic, 
categorical, and denotational characterizations. In Logic in Computer 
Science, pages 230-241, 1996. 


M. Parigot. Free deduction: An analysis of “computations” in classical 
logic. In Second Russian Conference on Logic programming, volume 
592 of Lecture Notes in Artificial Intelligence, pages 361-380. Springer- 
Verlag, 1991. 


M. Parigot. Ap-calculus: An algorithmic interpretation of classical 
natural deduction. In International Conference on Logic Programming 
and Automated Reasoning, volume 624 of Lecture Notes in Computer 
Science, pages 190-201. Springer-Verlag, 1992. 


M. Parigot. Classical proofs as programs. In Kurt Gödel Colloquium, 
volume 713 of Lecture Notes in Computer Science, pages 263-276. 
Springer-Verlag, 1993. 


M. Parigot. Strong normalization for second order classical natural 
deduction. In Logic in Computer Science, 1993. 


Bibliography 259 


83 


84 


85 


86 


87 


88 


89 


oO 
2 


91 


92 


93 


G. Plotkin. Call-by-name, call-by-value and the A-calculus. Theoretical 
Computer Science, 1:125-159, 1975. 


G. Pottinger. Normalization as a homomorphic image of cut- 
elimination. Annals of Mathematical Logic, 12:323-357, 1977. 


D. Prawitz. Natural Deduction: A Proof Theoretical Study. Almquist 
& Wiksell, 1965. 


D. Prawitz. Some results for intuitionistic logic with second order 
quantification. pages 259-270. North-Holland, Amsterdam, 1970. 


D. Prawitz. Ideas and results of proof theory. In Fenstad [34], pages 
235-307. 


H. Rasiowa and R. Sikorski. The Mathematics of Metamathematics. 
PWN, Warsaw, 1963. 


N.J. Rehof and M.H. Sørensen. The A, calculus. In M. Hagiya and 
J. Mitchell, editors, Theoretical Aspects of Computer Software, volume 
789 of Lecture Notes in Computer Science, pages 516-542. Springer- 
Verlag, 1994. 


J. Reynolds. Towards a theory of type structure. In B Robinet, edi- 
tor, Proceedings of the Programming Symposium, volume 19 of Lecture 
Notes in Computer Science, pages 408-425. Springer-Verlag, 1974. 


A. Rezus. Classical proofs: Lambda calculus methods in elementary 
proof theory, 1991. Manuscript. 


A. Rezus. Beyond BHK, 1993. Manuscript. 


J.A. Robinson. A machine-oriented logic based on the resolution prin- 
ciple. Journal of the Association for Computing Machinery, 12(1):23- 
41, 1965. 


J.B. Rosser. Highlights of the history of the lambda-calculus. Annals 
of the History of Computing, 6(4):337-349, 1984. 


A. Schubert. Second-order unification and type inference for church- 
style polymorphism. In Proc. 25th ACM Symposium on Principles of 
Programming Languages, pages 233-244, January 1998. 


H. Schwichtenberg. Elimination of higher type levels in definitions of 
primitive recursive function by means of transfinite recursion. In H.E. 
Rose, editor, Logic Colloquium ’73, pages 279-303. North-Holland, 
1975. 


260 


Bibliography 


[97] H. Schwichtenberg. Definierbare Funktionen im Lambda-Kalkul mit 


[98 


[99 


[100 


[101 


102 


103 


104 


105 


[106 


[107 


[108 


[109 


[110 


] 


] 


] 


Typen. Archiv Logik Grundlagenforsch., 17:113-114, 1976. 


J.P. Seldin and J.R. Hindley, editors. To H.B. Curry: Essays on 
Combinatory Logic, Lambda Calculus and Formalism. Academic Press 
Limited, 1980. 


D. Skvortsov. Non-axiomatizable second-order intuitionistic proposi- 
tional logic. Annals of Pure and Applied Logic, 86:33-46, 1997. 


S.K. Sobolev. On the intuitionistic propositional calculus with quan- 
tifiers (russian). Mat. Zamietki AN SSSR, 22(1):69-76, 1977. 


M.H. Sørensen. Normalization in A-Calculus and Type Theory. PhD 
thesis, Department of Computer Science, University of Copenhagen, 
1997. Available as DIKU Rapport 97/27. 


M.H. Sørensen. Strong normalization from weak normalization in 
typed A-calculi. Information and Computation, 133(1):35-71, 1997. 


R. Statman. Intuitionistic propositional logic is polynomial-space com- 
plete. Theoretical Computer Science, 9:67—72, 1979. 


W.W. Tait. Intensional interpretations of functionals of finite type I. 
Journal of Symbolic Logic, 32(2):190-212, 1967. 


W.W. Tait. A realizability interpretation of the theory of species. In 
R. Parikh, editor, Logic Colloquium, volume 453 of Lecture Notes in 
Mathematics, pages 240-251. Springer-Verlag, 1975. 


A.S. Troelstra. Metamathematical Investigation of Intuitionistic Arith- 
metic and Analysis, volume 344 of Lecture Notes in Mathematics. 
Springer-Verlag, 1973. 


A.S. Troelstra and D. van Dalen. Constructivism in Mathematics, 
An Introduction, Volume I, volume 121 of Studies in Logic and the 
Foundations of Mathematics. North-Holland, 1988. 


A.S. Troelstra and D. van Dalen. Constructivism in Mathematics, 
An Introduction, Volume IT, volume 123 of Studies in Logic and the 
Foundations of Mathematics. North-Holland, 1988. 


A.S. Troelstra and H. Schwichtenberg. Basic Proof Theory, volume 43 
of Cambridge Tracts in Theoretical Computer Science. Cambridge 
University Press, 1996. 


J. Tyszkiewicz. Złożoność problemu wyprowadzania typów w rachunku 
lambda. Master’s thesis, Warsaw, 1988. 


Bibliography 261 


[111] 


[112 


[113 


[114 


115 


116 


117 


[118] 


P. Urzyczyn. Positive recursive type assigment. In J. Wiedermann and 
P. Hájek, editors, Mathematical Foundations of Computer Science, 
volume 969 of Lecture Notes in Computer Science, pages 382-391. 
Springer-Verlag, 1995. 


P. Urzyczyn. Type inhabitation in typed lambda calculi (a syntactic 
approach). In de Groote P. and J.R. Hindley, editors, Typed Lambda 
Calculus and Applications, volume 1210 of Lecture Notes in Computer 
Science, pages 373-389. Springer-Verlag, 1995. 


R. Vestergaard. The cut rule and explicit substitutions. Manuscript, 
1998. 


A. Voronkov. Proof search in intuitionistic logic with equality or back 
to simultaneous rigid E-unification. In M.A. Mc Robbie and J.K. 
Slaney, editors, CADE-13, volume 1104 of Lecture Notes in Computer 
Science, pages 32-46. Springer-Verlag, 1996. 


P.L. Wadler. Deforestation: Transforming programs to eliminate in- 
termediate trees. Theoretical Computer Science, 73:231—248, 1990. 


P.L. Wadler. A Curry-Howard isomorphism for sequent calculus. 
Manuscript, 1993. 


J. Wells. Typability and type checking in the second-order A-calculus 
are equivalent and undecidable. In Proc. Symp. on Logic in Computer 
Sciene, pages 176-185. IEEE, Computer Society, Computer Society 
Press, 1994. 


J.I. Zucker. Correspondence between cut-elimination and normaliza- 
tion. Annals of Mathematical Logic, 7:1-156, 1974. 


